Mellium allows Authentication Bypass by Spoofing

KRITISCH 9.8CVE-2024-46957 · GHSA-98hf-m87w-cq6h · GO-2024-3157 · Published 25/09/2024 · updated 17/06/2026

Kurz gesagt

CVE-2024-46957 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in mellium.im/xmpp.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.61%, höher als bei 49.5% aller Schwachstellen.
Abhilfe: auf 0.22.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
mellium.im/xmpp Go	`< 0.22.0`	`0.22.0`

Description

Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing because the stanza type is not checked. This is fixed in 0.22.0.

NVD description

Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is not checked. This is fixed in 0.22.0.

References

nvd.nist.gov/vuln/detail/CVE-2024-46957 · ADVISORY
codeberg.org/mellium/xmpp · PACKAGE
codeberg.org/mellium/xmpp/releases · WEB
codeberg.org/mellium/xmpp/releases/tag/v0.22.0 · WEB
mellium.im/cve/cve-2024-46957 · WEB
mellium.im/cve/cve-2024-46957
GitHub Advisory GHSA-98hf-m87w-cq6h · ADVISORY

Weitere Schwachstellen in mellium.im/xmpp

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free