CVE-2026-43507: 
NixOS vulnerability analysis and mitigation

CVE-2026-43507 is a Denial of Service vulnerability in the Prosody XMPP server caused by XML parsing resource amplification from unauthenticated connections, leading to memory exhaustion. It affects all Prosody versions prior to 0.12.6 and versions 1.0.0 through 13.0.0 before 13.0.5. The vulnerability was disclosed on May 1, 2026, and was originally discovered and reported to the Prosody team by a researcher known as "Ley" prior to public disclosure. It carries a CVSS v3.1 base score of 7.5 (High) per NVD/Feedly, though the GitHub Advisory Database rates it 5.3 (Moderate) (GitHub Advisory, Openwall).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), with additional CWEs CWE-405 and CWE-772 cited by the vendor. Prosody's XML parser (via LuaExpat/libexpat) amplifies memory consumption significantly relative to the size of incoming data, meaning a small amount of attacker-controlled traffic can cause disproportionately large memory allocations. Compounding this, Prosody did not enforce limits on the total number of concurrent connections, allowing attackers to multiply the impact using multiple simultaneous unauthenticated connections. Additionally, per-connection resource leaks were identified where connections continued consuming memory even after the stream ended. The issue is also closely related to libexpat CVE-2025-59375; full protection requires LuaExpat to be linked against libexpat 2.7.2 or later (Openwall, GitHub Advisory).

Successful exploitation results in memory exhaustion on the Prosody XMPP server, causing Denial of Service that disrupts XMPP messaging services for all users of the affected instance. There is no confidentiality or integrity impact — the attack is purely an availability concern. Because no authentication is required, any network-reachable attacker can trigger the condition, making publicly exposed Prosody instances particularly at risk of service interruption or crash (Openwall, GitHub Advisory).

A proof-of-concept exploit exists and was published by the original reporter ("Ley") in a blog post referenced in the official advisory, though the Prosody developers caution against following the mitigations described in that post. There is no current evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.054–0.077%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Openwall, GitHub Advisory).

1. Reconnaissance: Identify internet-facing Prosody XMPP servers running versions prior to 0.12.6 or 13.0.5 by scanning for open XMPP ports (default 5222 for client connections, 5269 for server-to-server) using tools like Shodan or Censys.
2. Establish unauthenticated connections: Open multiple simultaneous TCP connections to the target Prosody server on port 5222 or 5269 without authenticating, exploiting the lack of total connection limits.
3. Send amplified XML payloads: Transmit crafted XML stanzas designed to trigger disproportionate memory allocation in Prosody's XML parser (LuaExpat/libexpat). The XML content is structured to maximize memory amplification relative to transmitted bytes (e.g., deeply nested elements or large attribute sets).
4. Sustain the attack: Maintain multiple concurrent connections and continue sending amplified XML data to progressively exhaust server memory. Per-connection resource leaks mean that even closed connections may continue consuming memory.
5. Achieve DoS: As server memory is exhausted, Prosody becomes unresponsive or crashes, denying XMPP service to all legitimate users (Openwall).

• Network: Unusually high number of concurrent inbound TCP connections to XMPP ports (5222, 5269) from one or few source IPs; high volume of small XML payloads from unauthenticated connections.
• Logs: Prosody logs showing a large number of unauthenticated connection attempts or stream openings without corresponding authentication events; repeated connection open/close cycles from the same IP.
• Process/System: Rapidly increasing memory consumption by the Prosody process (prosody or lua) visible via top, htop, or system monitoring tools; OOM (Out of Memory) killer events in system logs (/var/log/syslog or dmesg) referencing the Prosody process.
• File System: Core dump files generated by a Prosody crash in the working directory or /var/crash/.

Upgrade Prosody to version 0.12.6 (for 0.12.x deployments) or 13.0.5 (for 13.x deployments) to apply all fixes, including lower stanza size limits for unauthenticated streams, XML stanza complexity limits, and memory leak patches. Additionally, ensure LuaExpat is linked against libexpat 2.7.2 or later (verify with prosodyctl about). As an interim workaround, use a system firewall to rate-limit and cap total connections to XMPP ports — for example, ufw limit 5222 and ufw limit 5269, or use iptables/nftables connlimit rules. The Prosody team explicitly advises against drastically lowering per-connection bandwidth rate limits, as this can worsen resource consumption by keeping attacker connections active longer (Openwall, Prosody Advisory).

The Prosody development team issued a formal security advisory and coordinated disclosure via the oss-security mailing list, crediting the original reporter "Ley" for discovering and responsibly disclosing the resource amplification attack vector. The advisory notes that the Prosody team does not endorse the analysis or mitigations described in the reporter's blog post, suggesting some divergence in recommended remediation approaches. Debian issued a security advisory (DSA-6252-1) for Prosody, and Fedora also released updates, indicating broad downstream distribution response (Openwall, Prosody Advisory).