Apache Vysper XML parsing can exhaust memory on all versions
Original title: CVE-2026-115721: Apache Vysper: Unbounded allocation
CVE-2026-115721 is an unauthenticated network denial of service scored CVSS 7.5; the retired project will not be fixed.
Thomas Wolf reported CVE-2026-115721 in Apache Vysper, an XMPP server library. Unbounded allocation during XML parsing in every version can cause an out-of-memory condition. Apache rates the issue moderate, with CVSS 3.1 7.5, and says it was unsupported when assigned. Because the project is retired, maintainers do not plan a fix.
- The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
- Impact is availability only: no confidentiality or integrity effect is scored.
- No privileges or user interaction are required.
- Apache says it does not plan to address the retired project.
Impact: Remote unauthenticated denial of service via memory exhaustion
| Product | Affected |
|---|---|
| Apache Vysper | all versions |
- CVEs
- CVE-2026-115721
- Vendors
- Apache
- Products
- Apache Vysper
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115721 | Unbounded XML allocation DoS in Apache Vysper (all versions) | 7.5 | — |
From the original article
Posted by Thomas Wolf on Oct 23 Severity: moderate CVSS 3. 1: 7. 5 (high) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.