CVE-2026-115721: Apache Vysper: Unbounded allocation

Published Oct 23, 2026

Updated

UNSUPPORTED WHEN ASSIGNED Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition.

This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

Affected Software

1 affected component

Apache Vysper

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Find and use an alternative to Apache Vysper because the retired project will not release a version fixing the unbounded XML-parsing allocation issue.

Oct 26, 2026

CVE Published

via MITRE·03:01 PM

Data Sourced

via MITRE·03:01 PM

DescriptionSeverityWeakness

All versions of Apache Vysper are affected. The issue is in XML parsing and can lead to an out-of-memory condition.

No. The provided vector indicates network access, low attack complexity, no privileges required, and no user interaction.

No. Apache Vysper is retired, and the project does not plan to release a fixed version. Users are recommended to find an alternative.