BSD Portsejabberd -- Potential DDoS in XML Parser
ejabberd team reports: This release adds new options that limit max memory used by XML parser used to process XMPP payloads, to prevent potential Denial of Service attack. The default values for pre-auth provide sufficient protection for ejabberd against non-authenticated users on c2s and s2s, so there is no need to change your configuration.
Affected versions
- ejabberd < 26.04
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | net-im/ejabberd | 25.04 | vulnerable since 2026-04-21 | |
| OpenBSD | net/ejabberd | 26.09 | out of range, by version | |
| MidnightBSD | net-im/ejabberd | 25.04 | in range, by version | |
| FreeBSD | net-im/ejabberd | 26.09 | fixed | (102 days after) |