Description
jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jabberd2 | 2.2.8-2.1 | — |
| Debian 13 | jabberd2 | 2.2.8-2.1 | — |
| Debian 12 | jabberd2 | 2.2.8-2.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | jabberd | 2.2.8-12.el5sat | RHSA-2011:0882 |
| Red Hat Network Proxy 5 | jabberd | 2.2.8-12.el5sat | RHSA-2011:0881 |
Advisories 2
- RHSA-2011:0881 Red Hat Security Advisory: Red Hat Network Proxy server jabberd security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2011:0882 Red Hat Security Advisory: Red Hat Network Satellite server jabberd security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- jabberd-xml-entity-dos(67770) vdb-entry
- http://codex.xiaoka.com/svn/jabberd2/tags/jabberd-2.2.14/ChangeLog
- 44957 third-party-advisory
- 44787 third-party-advisory
- APPLE-SA-2011-10-12-3 vendor-advisory
- FEDORA-2011-7801 vendor-advisory
- RHSA-2011:0881 vendor-advisory
- SUSE-SU-2011:0741 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=700390
- FEDORA-2011-7805 vendor-advisory
- RHSA-2011:0882 vendor-advisory
- 48250 vdb-entry
- FEDORA-2011-7818 vendor-advisory
- http://support.apple.com/kb/HT5002
- 45112 third-party-advisory
- [jabberd2] 20110531 jabberd-2.2.14 release mailing-list