CVE-2026-115721

**UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread.html/d0bx15hjcs69gktk9tt25vgvk121c9vm
https://mina.apache.org/vysper-project/
http://www.openwall.com/lists/oss-security/2026/10/23/20

Configurations

No configuration.

History

02 Nov 2026, 22:17

Type	Values Removed	Values Added
CWE		CWE-770

26 Oct 2026, 16:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-26 16:17

Updated : 2026-11-02 22:17

NVD link : CVE-2026-115721

Mitre link : CVE-2026-115721

CVE.ORG link : CVE-2026-115721

JSON object : View

Products Affected

No product.

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-115721", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "security@apache.org"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115721", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T21:21:07.180397Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Vysper", "versions": [{"status": "affected", "version": "0", "versionType": "maven", "lessThanOrEqual": "*"}], "packageURL": "pkg:maven/org.apache.vysper/vysper", "packageName": "org.apache.vysper:vysper", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-10-26T16:17:17.673", "references": [{"url": "https://lists.apache.org/thread.html/d0bx15hjcs69gktk9tt25vgvk121c9vm", "source": "security@apache.org"}, {"url": "https://mina.apache.org/vysper-project/", "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/23/20", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "**UNSUPPORTED WHEN ASSIGNED**\u00a0\u00a0Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition.\n\n\n\n\nThis issue affects all versions of Apache Vysper.\u00a0Apache Vysper is an XMPP (Jabber) server library.\n\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative."}], "lastModified": "2026-11-02T22:17:18.847", "sourceIdentifier": "security@apache.org"}