Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-115721— Apache Vysper: Unbounded allocation

Quick assessment

Affected

Apache Software Foundation Apache Vysper

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

分配时不支持：Apache Vysper 在解析 XML 时存在无界内存分配漏洞，影响所有版本，可能导致内存耗尽（Out of Memory）。此问题影响 Apache Vysper 的所有版本。Apache Vysper 是一个 XMPP（Jabber）服务器库。由于该项目已停止维护，我们计划不再发布修复此问题的版本。建议用户寻找替代方案。

CVSS 7.5 · High EPSS 0.47% · P41 Updated Oct 26, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Apache Software Foundation	Apache Vysper	`≤ *`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache Vysper: Unbounded allocation

Source: CVE Program / CVE List V5

Vulnerability Description

**UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache Vysper	0 ~ *	-

II. Public POCs for CVE-2026-115721

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115721

请登录查看更多情报信息。

Mailing List Discussions for CVE-2026-115721 (1)

🔗 CVE-2026-115721: Apache Vysper: Unbounded allocation - ASF Mailing List Archives vendor-advisory

Other References for CVE-2026-115721 (1)

https://mina.apache.org/vysper-project/

https://www.cve.org/CVERecord?id=CVE-2026-115721

Same Patch Batch · Apache Software Foundation · 2026-10-26 · 12 CVEs total

CVE-2026-115748	8.8 HIGH	Apache Vysper: Authorization bypass
CVE-2026-90885	7.5 HIGH	Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message
CVE-2026-95628	5.4 MEDIUM	Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute P
CVE-2026-95629	5.4 MEDIUM	Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Outp
CVE-2026-95664	5.4 MEDIUM	Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS
CVE-2026-101259	5.3 MEDIUM	Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
CVE-2026-94386	4.8 MEDIUM	Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Cre
CVE-2026-95663	4.8 MEDIUM	Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached
CVE-2026-111422		Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as sh
CVE-2026-110748		Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files
CVE-2026-110733		Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature stor

IV. Related Vulnerabilities

Same product: Apache Vysper

CVE-2026-115748
Apache Vysper: Authorization bypass

Same vendor: Apache Software Foundation