AI and data stack advisories

Severe, 6 weeks977Projects326

977 severe, 6 weeks · 326 projects

Apache Software FoundationCVE-2026-115721

Apache Vysper: resource exhaustion

Apache Software Foundation

CVE-2026-115721 · Published Oct 26, 2026 · updated Nov 2, 2026

High7.5
No fix yet
Apache Software Foundation advisory

UNSUPPORTED WHEN ASSIGNED  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition.

This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

Affected versions

PackageAffectedFixed in
Apache Vysper
Product
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-770

More Apache Software Foundation advisories

All Apache Software Foundation
High 8.8Oct 27Apache Airflow SSH provider: command injectionCVE-2026-111422fixed in 7.0.1High 8.8Oct 26Apache Vysper: insecure direct object referenceCVE-2026-115748no fix yetMedium 4.8Oct 26Apache Camel: insufficient session expirationCVE-2026-95663fixed in 4.18.5 +1Medium 5.4Oct 26Apache Camel: expression injectionCVE-2026-95664fixed in 4.18.5 +1Medium 5.4Oct 26Apache Camel: path traversalCVE-2026-95629fixed in 4.18.5 +1Medium 5.3Oct 26Apache Camel: information disclosureCVE-2026-101259fixed in 4.18.5 +1