CVE-2026-112063Medium· 5.9▾ TwilightPoC availableA flaw was found in libstrophe. A malicious XMPP (Extensible Messaging and Presence Protocol) server can exploit a stack-based buffer overflow in the SCRAM (Salted Challenge Response Authentication Mechanism) authentication handler by send…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 32.5 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
Exploit / PoC code exists
0.2%
Last analysed / modified upstream
0.2% → 0.3%
A flaw was found in libstrophe. A malicious XMPP (Extensible Messaging and Presence Protocol) server can exploit a stack-based buffer overflow in the SCRAM (Salted Challenge Response Authentication Mechanism) authentication handler by sending an oversized salt value. This issue allows an attacker to cause the client application to crash, resulting in a Denial of Service (DoS), or potentially corrupt stack memory.
libstrophe: libstrophe: Denial of Service via oversized SCRAM salt. Released 2026-10-18, updated 2026-10-21.
Not affected:
Refer to the advisory for fix availability.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116149High· 7.8ImageMagick: ImageMagick: Memory corruption via crafted bzip2 compressed images (CVE-2026-116149)
CVE-2026-92183High· 7.8gimp: gimp: Arbitrary code execution via stack-based buffer overflow in APNG parser (CVE-2026-92183)
CVE-2026-106071Low· 3.6nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
CVE-2026-106072Medium· 6.7nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)
CVE-2026-106073Low· 3.3nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
CVE-2026-106070Low· 3.7nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch (CVE-2026-106070)