CVE-2026-43504

MediumCVSS 6.5/10Last modified Nov 11, 2026

Description

An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in a paused scenario, relaying of unauthenticated traffic can occur.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Prosody	Prosody	< 0.12.6; >= 1.0.0, < 13.0.5

References

https://prosody.im/security/advisory_735dd9d3/Mitigation, Patch, Vendor Advisory
https://www.openwall.com/lists/oss-security/2026/05/01/5Mailing List, Patch, Third Party Advisory

Timeline

Published: May 1, 2026
Last modified: Nov 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-435056.5An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mi CVE-2026-435067.5An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion CVE-2026-435077.5An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion CVE-2026-43518.1The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in all versions up to, and including, 2.5.CVE-2026-435105.9manage.get.gov is the .gov TLD registrar maintained by CISA. manage.get.gov allows an organization administrator to assign domain manager pr CVE-2026-435129.8DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11 CVE-2026-435137.5Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 thro CVE-2026-435143.7Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 th CVE-2026-435159.1Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This i CVE-2026-43527.5The JetEngine plugin for WordPress is vulnerable to SQL Injection via the Custom Content Type (CCT) REST API search endpoint in all versions CVE-2026-435269.3OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fe CVE-2026-435277.7OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation