Apache Vysper XML parsing can exhaust memory on all versions
CVE-2026-115721 is an unauthenticated network denial of service scored CVSS 7.5; the retired project will not be fixed.
38
Vulnerability1 · 1 read
CVE-2026-115721
Unbounded XML allocation DoS in Apache Vysper (all versions)
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Vysper, a retired XMPP (Jabber) server library, allocates memory without bounds while parsing XML. A remote attacker can trigger this over the network with no authentication or user interaction, exhausting memory and causing an out-of-memory denial of service. Every version is affected, and the project will not ship a fix.
What to do: Apache will not release a fix because Vysper is retired. Stop using it and move to an alternative XMPP server.
| Product | Affected |
|---|---|
| Apache Vysper | all versions |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
**UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H