Unbounded Allocation in XML Parsing in Apache Vysper by Apache
CVE-2026-115721

7.5HIGH

Key Information:

Vendor

Apache
Status
Apache Vysper
Vendor
CVE Published:
26 October 2026

What is CVE-2026-115721?

The vulnerability in Apache Vysper arises from unbounded allocation during XML parsing, potentially resulting in an out-of-memory condition. This affects all versions of Apache Vysper, which is an XMPP (Jabber) server library. Given that this project is no longer maintained, users are advised to transition to alternative solutions to ensure continued security and functionality.

Affected Version(s)

Apache Vysper 0

References

https://mina.apache.org/vysper-project/
https://lists.apache.org/thread.html/d0bx15hjcs69gktk9tt2...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gjoko Krstic (Zero Science Lab)
.