Cyber ·
CVE-2026-115721: Apache Vysper has unbounded allocation during XML parsing
Advisory dated October 23, 2026 on unbounded allocation during XML parsing in Apache Vysper, an XMPP server library. The issue can exhaust memory. Rated moderate, CVSS 3.1 score 7.5, and all versions are listed as affected.
Advisory published October 23, 2026 on the oss-sec feed, machine-translated: XML parsing in Apache Vysper, an XMPP server library, performs unbounded allocation that can exhaust memory and cause an out-of-memory condition. The flaw is tracked as CVE-2026-115721 and rated moderate, with CVSS 3.1 score 7.5 (high), network attack vector, no privileges and no user interaction required, and impact stated on availability. The text says all versions of Apache Vysper are affected. The available excerpt notes the project is retired, but it cuts off before describing fix plans. For official guidance on updates or mitigations, consult the original CVE and project sources, since the translation may not reflect the full text.
Original source: CVE-2026-115721: Apache Vysper — alocação sem limites