USN-9056-1: prosody-modules vulnerability

Q: Which deployments are exposed to this issue?

Deployments using the LDAP authentication modules in Prosody Community Modules are affected by the privilege-checking flaw.

Q: Does exploitation require local access?

No. The issue may be exploited by a remote attacker to obtain administrator privileges.

Published Nov 11, 2026

Updated

It was discovered that the LDAP authentication modules in Prosody Community Modules did not fully verify XMPP addresses when checking for administrator privileges. A remote attacker could possibly use this issue to gain administrator privileges.

Affected Software

6 affected componentsFixes available

ubuntu/prosody-modules<0.0~hg20150813.12ac88940fe3-2ubuntu0.1~esm1

0.0~hg20150813.12ac88940fe3-2ubuntu0.1~esm1

ubuntu/prosody-modules<0.0~hg20170929.c53cc1ae4788+dfsg-3ubuntu0.1~esm1

0.0~hg20170929.c53cc1ae4788+dfsg-3ubuntu0.1~esm1

All of the following

ubuntu/prosody-modules<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

All of the following

ubuntu/prosody-modules<0.0~hg20150813.12ac88940fe3-2ubuntu0.1~esm1

0.0~hg20150813.12ac88940fe3-2ubuntu0.1~esm1

Ubuntu Ubuntu=16.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/prosody-modules to a version that resolves this vulnerability.
Fixed in 0.0~hg20150813.12ac88940fe3-2ubuntu0.1~esm1
Upgrade
Upgrade ubuntu/prosody-modules to a version that resolves this vulnerability.
Fixed in 0.0~hg20170929.c53cc1ae4788+dfsg-3ubuntu0.1~esm1
Upgrade
Upgrade ubuntu/prosody-modules to a version that resolves this vulnerability.
Fixed in Ubuntu Pro

Event History

Nov 11, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Advisory Published

via OSV·06:32 PM

Data Sourced

via OSV·06:32 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployments are exposed to this issue?