CVE-2026-115721

HighCVSS 7.5

Published: 26/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

41th percentile - higher than 41% of all known CVEs

Summary

Apache Vysper, an XMPP (Jabber) server library, in all versions contains unbounded allocation in XML parsing, which may lead to an out-of-memory condition. The project is retired and no fix will be released.

Risk Assessment

Unbounded memory allocation during XML parsing can cause an out-of-memory condition and service crash. Lack of vendor support means no future security fixes.

Recommendation

Users are recommended to find an alternative to Apache Vysper. Until migration, limit the size of processed XML documents and monitor memory usage.

Other vulnerabilities in Apache Vysper

CVE-2026-115748High
Apache Vysper, an XMPP (Jabber) server library, in all versions is missing an authentication check in its XEP-0077 (In-Band Registration) implementation. Any authenticated user can compromise other accounts. The project is retired and no fix will be released.

Original NVD description (English source)

**UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS