CVE-2014-2741
highpriority · track · 32EPSS 0.038 · 90 %ileEUUSEPSS · scored 2026-10-28
nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–7.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-j5qh-cp3p-2h87Ignite Realtime Openfire vulnerable to XMPPbomb attack2022-05-17ghsa · osvUS
nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (17)
External citations — patches, advisories, analysis.
- http://fisheye.igniterealtime.org/changelog/Patchcnnvd
- http://openwall.com/lists/oss-security/2014/04/07/7cnnvd
- http://openwall.com/lists/oss-security/2014/04/09/1cnnvd
- http://secunia.com/advisories/57704cnnvd
- http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/cnnvd
- http://community.igniterealtime.org/thread/52317enisa_euvd
- http://fisheye.igniterealtime.org/changelog/openfiregit?cs=3aec383e07ee893b77396fe946766bbd3758af77enisa_euvd
- http://openwall.com/lists/oss-security/2014/04/07/7enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan