CVE-2026-43504: Medium severity Prosody prosody vulnerability

Q: What is the severity of CVE-2026-43504?

CVE-2026-43504 has been assessed with a high severity due to its potential to allow relaying of unauthenticated traffic.

Q: How do I fix CVE-2026-43504?

To fix CVE-2026-43504, update Prosody to version 0.12.6 or any version from 13.0.5 onwards.

Q: What versions of Prosody are affected by CVE-2026-43504?

CVE-2026-43504 affects Prosody versions before 0.12.6 and versions from 1.0.0 to 13.0.0 before 13.0.5.

Q: What is the main issue introduced by CVE-2026-43504?

The main issue introduced by CVE-2026-43504 is the mishandling of access control in mod_proxy65 when it is paused.

Q: Can CVE-2026-43504 result in unauthorized access?

Yes, CVE-2026-43504 can result in unauthorized access by allowing unauthenticated traffic to be relayed.

Published May 1, 2026

Updated

An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when modproxy65 is enabled. Because modproxy65 mishandles access control in a paused scenario, relaying of unauthenticated traffic can occur.

Affected Software

9 affected componentsFixes available

Prosody prosody<0.12.6, >=1.0.0<=13.0.0, <13.0.5

Prosody prosody<0.12.6

Prosody prosody>=13.0.0<13.0.5

alpine/prosody>=13.0.0<13.0.5-r0

13.0.5-r0

alpine/prosody>=13.0.0<13.0.5-r0

13.0.5-r0

debian/prosody<0.12.3-1+deb12u1

0.12.3-1+deb12u1

debian/prosody<13.0.1-1+deb131u

13.0.1-1+deb131u

debian/prosody<13.0.5-1

13.0.5-1

debian/prosody

0.12.3-1+deb12u113.0.1-1+deb131u13.0.7-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/prosody to a version that resolves this vulnerability.
Fixed in 13.0.5-r0
Upgrade
Upgrade debian/prosody to a version that resolves this vulnerability.
Fixed in 0.12.3-1+deb12u1
Upgrade
Upgrade debian/prosody to a version that resolves this vulnerability.
Fixed in 13.0.1-1+deb131u
Upgrade
Upgrade debian/prosody to a version that resolves this vulnerability.
Fixed in 13.0.5-1
Upgrade
Upgrade debian/prosody to a version that resolves this vulnerability.
Fixed in 0.12.3-1+deb12u1Fixed in 13.0.1-1+deb131uFixed in 13.0.7-1
Upgrade
Upgrade Prosody to a version that resolves this vulnerability.
Fixed in 0.12.6
Upgrade
Upgrade Prosody to a version that resolves this vulnerability.
Fixed in 13.0.5

Event History

May 1, 2026

CVE Published

via MITRE·02:40 PM

Data Sourced

via MITRE·02:40 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·03:16 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-6252

Frequently Asked Questions

What is the severity of CVE-2026-43504?

CVE-2026-43504 has been assessed with a high severity due to its potential to allow relaying of unauthenticated traffic.

How do I fix CVE-2026-43504?

To fix CVE-2026-43504, update Prosody to version 0.12.6 or any version from 13.0.5 onwards.

What versions of Prosody are affected by CVE-2026-43504?

CVE-2026-43504 affects Prosody versions before 0.12.6 and versions from 1.0.0 to 13.0.0 before 13.0.5.

What is the main issue introduced by CVE-2026-43504?

The main issue introduced by CVE-2026-43504 is the mishandling of access control in mod_proxy65 when it is paused.

Can CVE-2026-43504 result in unauthorized access?

Yes, CVE-2026-43504 can result in unauthorized access by allowing unauthenticated traffic to be relayed.

CVE-2026-43504: Medium severity Prosody prosody vulnerability

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is the severity of CVE-2026-43504?

How do I fix CVE-2026-43504?

What versions of Prosody are affected by CVE-2026-43504?

What is the main issue introduced by CVE-2026-43504?

Can CVE-2026-43504 result in unauthorized access?

Company

Resources

Contact