Prosody XMPP Server Uncontrolled CPU Consumption Vulnerability
CVE-2021-32920

7.5HIGH

Key Information:

Vendor: Prosody
Status: Prosody
Vendor: CVE Published:; 13 May 2021

🔔 Create Prosody Vulnerability Alert

What is CVE-2021-32920?

A vulnerability in the Prosody XMPP server before version 0.11.9 allows attackers to exploit uncontrolled CPU consumption through a barrage of SSL/TLS renegotiation requests. This can lead to service degradation or denial of service, as the server becomes overwhelmed by the excessive volume of requests.

References

https://blog.prosody.im/prosody-0.11.9-released/

x_refsource_MISC

http://www.openwall.com/lists/oss-security/2021/05/13/1

mailing-listx_refsource_MLIST

http://www.openwall.com/lists/oss-security/2021/05/14/2

mailing-listx_refsource_MLIST

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 13, 2021
Vulnerability Reserved
May 12, 2021

CVE-2021-32920 Data

.