Prosody XMPP Server Security Advisory: CVE-2025-9975/9976/9977 (DoS & Unauth Proxy)

Prosody XMPP Server Security Advisory Summary (2026-04-29) Vulnerability Overview This advisory covers two security vulnerabilities in the Prosody XMPP server software: 1. Denial of Service (DoS) due to Memory Exhaustion: Attackers can consume significant server memory by sending a small amount of unauthenticated traffic. 2. Unauthenticated SOCKS5 Proxy Usage (mod_proxy65): Due to flawed access controls, unauthenticated users are allowed to send data through the proxy. Scope of Impact Affected Versions: All versions prior to 13.0.5. Fixed Versions: 12.6 and 13.0.5. Remediation Upgrade Software: All Prosody users are advised to upgrade to version 13.0.5 or 12.6. Firewall Restrictions: Configure the system firewall to limit connection rates and total connection counts. Example using : Use the feature in iptables/nftables to restrict the number of connections per IP address. Reduce Rate Limits: It is recommended to significantly lower the per-connection bandwidth rate limits in Prosody (refer to the original report blog), although this may increase resource consumption. Disable mod_proxy65: If file transfer functionality is not required, can be disabled, though this will impact file transfer capabilities. Detailed Vulnerability Information 1. Denial of Service (DoS) due to Memory Exhaustion CVE: CVE-2025-9975, CVE-2025-9976 CVSS: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Description: Traffic patterns were identified that cause Prosody to consume excessive memory, even with minimal traffic volume. Prosody's per-connection rate limiting protection is weakened by the amplification effect of memory usage relative to transmitted data. Prosody does not enforce a limit on the total number of connections; attackers can exacerbate the impact by increasing concurrent connections. The attack reveals per-connection resource consumption issues, where connections may continue to consume resources even after the stream has ended. Fix: Introduced stanza size limits for unauthenticated streams. Fixed four memory leaks (two for unauthenticated, two for authenticated). Introduced functionality to configure per-IP connection limits (experimental status; using system firewalls is recommended as the primary mitigation). 2. Unauthenticated SOCKS5 Proxy Usage (mod_proxy65) CVE: CVE-2025-9977 CVSS: 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Description: Access controls in are broken and incomplete. Due to changes in the default network backend, considers "paused" connections as actually capable of sending data. only checks access control rules during the protocol's discoverability phase, not during the activation phase. Entities capable of guessing the proxy domain and port can bypass the discoverability phase and use the proxy directly. Limitations: is designed to facilitate file transfers and other binary streams; it is not a general-purpose SOCKS5 proxy. It does not initiate outbound connections, so it may be abused to forward an attacker's connections to arbitrary endpoints. It requires both parties to establish a connection to the proxy and perform a SOCKS5 handshake. Fix: Fixed the issue allowing unauthenticated connections. * Fixed missing authorization checks.

Goal Reached Thanks to every supporter — we hit 100%!

Prosody XMPP Server Security Advisory: CVE-2025-9975/9976/9977 (DoS & Unauth Proxy)

More from this source