Vulnerability Database

300,214

Total vulnerabilities in the database

CVE-2014-2745

Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack, related to core/portmanager.lua and util/xmppstream.lua.

  • Published: Apr 11, 2014
  • Updated: Nov 9, 2025
  • CVE: CVE-2014-2745
  • Severity: High
  • Exploit:

CVSS v2:

  • Severity: High
  • Score: 7.8
  • AV:N/AC:L/Au:N/C:N/I:N/A:C

CWEs:

Software From Fixed in
prosody / prosody 0.6.0 0.6.0.x
prosody / prosody - 0.9.3.x
prosody / prosody 0.4.2 0.4.2.x
prosody / prosody 0.9.2 0.9.2.x
prosody / prosody 0.5.0 0.5.0.x
prosody / prosody 0.6.1 0.6.1.x
prosody / prosody 0.5.2 0.5.2.x
prosody / prosody 0.9.0 0.9.0.x
prosody / prosody 0.4.0 0.4.0.x
prosody / prosody 0.7.0 0.7.0.x
prosody / prosody 0.3.0 0.3.0.x
prosody / prosody 0.8.0 0.8.0.x
prosody / prosody 0.2.0 0.2.0.x
prosody / prosody 0.4.1 0.4.1.x
prosody / prosody 0.8.2 0.8.2.x
prosody / prosody 0.8.1 0.8.1.x
prosody / prosody 0.6.2 0.6.2.x
prosody / prosody 0.1.0 0.1.0.x
prosody / prosody 0.9.1 0.9.1.x
prosody / prosody 0.5.1 0.5.1.x