BSD Portsejabberd -- Multiple security vulnerabilities
ejabberd team reports: Unauthenticated Remote Code Execution on ejabberd (reported by Gia Bui) when: ejabberd versions is at least 25.10 BOSH is enabled on any port S2S is enabled mod_adhoc_api is loaded outbound connectivity from ejabberd on ports epmd (default 4369), s2s (default 5269) and Erlang distribution port (dynamically assigned, typically in the range 49152-65535 unless FIREWALL_WINDOW is set in …
Affected versions
- ejabberd < 26.09
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | net-im/ejabberd | 25.04 | vulnerable since 2026-10-10 | |
| OpenBSD | net/ejabberd | 26.09 | out of range, by version | |
| MidnightBSD | net-im/ejabberd | 25.04 | in range, by version | |
| FreeBSD | net-im/ejabberd | 26.09 | fixed |