CVE-2026-43505: Medium severity Prosody prosody vulnerability

Q: What is the severity of CVE-2026-43505?

CVE-2026-43505 is considered a medium severity vulnerability as it allows relaying of unauthenticated traffic due to access control mishandling.

Q: How do I fix CVE-2026-43505?

To fix CVE-2026-43505, update Prosody to version 0.12.6 or 13.0.5 or later.

Q: What versions of Prosody are affected by CVE-2026-43505?

CVE-2026-43505 affects Prosody versions prior to 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5.

Q: What does mod_proxy65 do that makes CVE-2026-43505 a concern?

Mod_proxy65 mishandles access control, which can lead to unauthorized access and relaying of unauthenticated traffic.

Q: Is CVE-2026-43505 related to any specific module in Prosody?

Yes, CVE-2026-43505 is specifically related to the mod_proxy65 module in Prosody.

Published May 1, 2026

Updated

An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when modproxy65 is enabled. Because modproxy65 mishandles access control in the activation scenario, relaying of unauthenticated traffic can occur.

Affected Software

9 affected componentsFixes available

Prosody prosody<0.12.6, >=1.0.0<13.0.5

Prosody prosody<0.12.6

Prosody prosody>=13.0.0<13.0.5

alpine/prosody>=13.0.0<13.0.5-r0

13.0.5-r0

alpine/prosody>=13.0.0<13.0.5-r0

13.0.5-r0

debian/prosody<0.12.3-1+deb12u1

0.12.3-1+deb12u1

debian/prosody<13.0.1-1+deb131u

13.0.1-1+deb131u

debian/prosody<13.0.5-1

13.0.5-1

debian/prosody

0.12.3-1+deb12u113.0.1-1+deb131u13.0.7-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/prosody to a version that resolves this vulnerability.
Fixed in 13.0.5-r0
Upgrade
Upgrade debian/prosody to a version that resolves this vulnerability.
Fixed in 0.12.3-1+deb12u1
Upgrade
Upgrade debian/prosody to a version that resolves this vulnerability.
Fixed in 13.0.1-1+deb131u
Upgrade
Upgrade debian/prosody to a version that resolves this vulnerability.
Fixed in 13.0.5-1
Upgrade
Upgrade debian/prosody to a version that resolves this vulnerability.
Fixed in 0.12.3-1+deb12u1Fixed in 13.0.1-1+deb131uFixed in 13.0.7-1
Upgrade
Upgrade Prosody to a version that resolves this vulnerability.
Fixed in 0.12.6
Upgrade
Upgrade Prosody to a version that resolves this vulnerability.
Fixed in 13.0.5

Event History

May 1, 2026

CVE Published

via MITRE·02:42 PM

Data Sourced

via MITRE·02:42 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·03:16 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-6252

Frequently Asked Questions

What is the severity of CVE-2026-43505?

CVE-2026-43505 is considered a medium severity vulnerability as it allows relaying of unauthenticated traffic due to access control mishandling.

How do I fix CVE-2026-43505?

To fix CVE-2026-43505, update Prosody to version 0.12.6 or 13.0.5 or later.

What versions of Prosody are affected by CVE-2026-43505?

CVE-2026-43505 affects Prosody versions prior to 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5.

What does mod_proxy65 do that makes CVE-2026-43505 a concern?

Mod_proxy65 mishandles access control, which can lead to unauthorized access and relaying of unauthenticated traffic.

Is CVE-2026-43505 related to any specific module in Prosody?

Yes, CVE-2026-43505 is specifically related to the mod_proxy65 module in Prosody.

CVE-2026-43505: Medium severity Prosody prosody vulnerability

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is the severity of CVE-2026-43505?

How do I fix CVE-2026-43505?

What versions of Prosody are affected by CVE-2026-43505?

What does mod_proxy65 do that makes CVE-2026-43505 a concern?

Is CVE-2026-43505 related to any specific module in Prosody?

Company

Resources

Contact