CyberSecBulletin

Mellium vulnerabilities

We track 2 vulnerabilities in Mellium products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 25, 2024.

2vulnerabilities
2critical
0high
0exploited
9.8average CVSS score

Latest Mellium vulnerabilities

  • 9.8 Critical severity

    xmpp: Authentication Bypass by Spoofing

    CVE-2024-46957Mellium

    Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is not checked. This is fixed in 0.22.0.

  • 9.8 Critical severity

    Sasl: Improper Authentication

    CVE-2022-48195Mellium

    An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated (instead, the nonce is empty). This causes authentication t