CVE-2014-2741

High

Published: 11/04/2014(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

In Openfire versions before 3.9.2, there is a vulnerability in nio/XMLLightweightParser.java that does not properly restrict the processing of compressed XML elements. This allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, known as an 'xmppbomb' attack.

Risk Assessment

Attackers can exploit this vulnerability to overload the server, leading to its unavailability for users. This may result in significant disruptions to communication services within the organization.

Recommendation

It is recommended to upgrade Openfire to version 3.9.2 or later to mitigate this vulnerability. Additionally, monitoring XMPP traffic for potential attacks is advisable.

Other vulnerabilities in Openfire

CVE-2023-32315HighActively exploited
A path traversal vulnerability in Openfire's administrative console allows an unauthenticated user to access restricted pages reserved for administrators. Affects all versions since 3.10.0. Patched in 4.7.5 and 4.6.8.

Original NVD description (English source)

nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS