CVE-2026-43506 MEDIUM

CVE-2026-43506

Vendor Prosody

Product Prosody

Weakness CWE-401

Published May 1, 2026

Last update May 1, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by memory leaks from unauthenticated connections.

Key dates

02Disclosure timeline

May 1, 2026 CVE published

May 1, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-43506 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/401.html

Identifiers

CVE CVE-2026-43506

CWE CWE-401

CVSS 5.3 / MEDIUM

Affected versions

Vendor Prosody

Product Prosody

Affected < 0.12.6

Vendor Prosody

Product Prosody

Affected ≥ 1.0.0 and < 13.0.5