CVE-2026-43506: High severity Prosody prosody vulnerability

Q: What is the severity of CVE-2026-43506?

CVE-2026-43506 has been classified as a high severity vulnerability due to its potential to cause Denial of Service through memory exhaustion.

Q: How do I fix CVE-2026-43506?

To fix CVE-2026-43506, you should upgrade to Prosody version 0.12.6 or 1.0.0 after 13.0.5.

Q: What causes CVE-2026-43506?

CVE-2026-43506 is caused by memory leaks from unauthenticated connections that lead to memory exhaustion.

Q: Which versions of Prosody are affected by CVE-2026-43506?

CVE-2026-43506 affects Prosody versions before 0.12.6 and those between 1.0.0 and 13.0.0 before 13.0.5.

Q: What type of vulnerability is CVE-2026-43506?

CVE-2026-43506 is classified as a Denial of Service vulnerability.

Published May 1, 2026

Updated

An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by memory leaks from unauthenticated connections.

Affected Software

11 affected componentsFixes available

Prosody prosody<0.12.6, >=1.0.0<13.0.5

Prosody prosody<0.12.6

Prosody prosody>=13.0.0<13.0.5

alpine/prosody>=13.0.0<0.12.6-r0

0.12.6-r0

alpine/prosody>=13.0.0<0.12.6-r0

0.12.6-r0

alpine/prosody>=13.0.0<13.0.5-r0

13.0.5-r0

alpine/prosody>=13.0.0<13.0.5-r0

13.0.5-r0

debian/prosody<0.12.3-1+deb12u1

0.12.3-1+deb12u1

debian/prosody<13.0.1-1+deb131u

13.0.1-1+deb131u

debian/prosody<13.0.5-1

13.0.5-1

debian/prosody

0.12.3-1+deb12u113.0.1-1+deb131u13.0.7-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/prosody to a version that resolves this vulnerability.
Fixed in 0.12.6-r0
Upgrade
Upgrade alpine/prosody to a version that resolves this vulnerability.
Fixed in 13.0.5-r0
Upgrade
Upgrade debian/prosody to a version that resolves this vulnerability.
Fixed in 0.12.3-1+deb12u1
Upgrade
Upgrade debian/prosody to a version that resolves this vulnerability.
Fixed in 13.0.1-1+deb131u
Upgrade
Upgrade debian/prosody to a version that resolves this vulnerability.
Fixed in 13.0.5-1
Upgrade
Upgrade debian/prosody to a version that resolves this vulnerability.
Fixed in 0.12.3-1+deb12u1Fixed in 13.0.1-1+deb131uFixed in 13.0.7-1

Event History

May 1, 2026

CVE Published

via MITRE·02:45 PM

Data Sourced

via MITRE·02:45 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·03:16 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-6252

Frequently Asked Questions

What is the severity of CVE-2026-43506?

CVE-2026-43506 has been classified as a high severity vulnerability due to its potential to cause Denial of Service through memory exhaustion.

How do I fix CVE-2026-43506?

To fix CVE-2026-43506, you should upgrade to Prosody version 0.12.6 or 1.0.0 after 13.0.5.

What causes CVE-2026-43506?

CVE-2026-43506 is caused by memory leaks from unauthenticated connections that lead to memory exhaustion.

Which versions of Prosody are affected by CVE-2026-43506?

CVE-2026-43506 affects Prosody versions before 0.12.6 and those between 1.0.0 and 13.0.0 before 13.0.5.

What type of vulnerability is CVE-2026-43506?

CVE-2026-43506 is classified as a Denial of Service vulnerability.

CVE-2026-43506: High severity Prosody prosody vulnerability

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is the severity of CVE-2026-43506?

How do I fix CVE-2026-43506?

What causes CVE-2026-43506?

Which versions of Prosody are affected by CVE-2026-43506?

What type of vulnerability is CVE-2026-43506?

Company

Resources

Contact