CVE-2026-115721

HighCVSS 7.5/10Last modified Nov 2, 2026

Description

**UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition.

This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

VendorProductVersions
Apache Software FoundationApache Vysper<= *

References

Timeline

Published
Oct 26, 2026
Last modified
Nov 2, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1157226.1RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list propeCVE-2026-1157237.4Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow CVE-2026-1157242.9VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based onCVE-2026-1157254.2Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplCVE-2026-1157267.8Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aiderCVE-2026-1157278.1AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while CVE-2026-1157287.5@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an inCVE-2026-1157296.8@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFCVE-2026-115737.1Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::sCVE-2026-1157303.1i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplyinCVE-2026-1157319.4Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a clieCVE-2026-1157329.0Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products,
CVE-2026-115721: High severity, CVSS 7.5 | Vulnix