Prosody vulnerabilities
We track 3 vulnerabilities in Prosody products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on May 1, 2026.
Latest Prosody vulnerabilities
- 7.5 High severity
Prosody: Allocation of Resources Without Limits or Throttling
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by XML parsing resource amplification from unauthenticated connections.
- 7.5 High severity
Prosody: Missing Release of Memory after Effective Lifetime
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by memory leaks from unauthenticated connections.
- 7.5 High severity
prosody: Improper Restriction of XML External Entity Reference
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776)