---
id: CVE-2026-112063
title: >-
  libstrophe: libstrophe: Denial of Service via oversized SCRAM salt
  (CVE-2026-112063)
summary: >-
  A flaw was found in libstrophe. A malicious XMPP (Extensible Messaging and
  Presence Protocol) server can exploit a stack-based buffer overflow in the
  SCRAM (Salted Challenge Response Authentication Mechanism) authentication
  handler by send…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H'
cvssSource: vendor
cwe:
  - CWE-121
vendor: Red Hat
product: libstrophe
affected:
  - libstrophe <= 0.14.0
published: '2026-10-18'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T09:34:52+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112063.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112063.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-112063'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-112063'
  - url: 'https://hackmd.io/@haindpwn/libstrophe-scram-salt-stack-overflow'
  - url: 'https://github.com/strophe/libstrophe/blob/0.14.0/src/scram.c'
  - url: 'https://github.com/strophe/libstrophe/blob/0.14.0/src/sasl.c'
  - url: >-
      https://www.vulncheck.com/advisories/libstrophe-through-0.14.0-stack-based-buffer-overflow-via-scram-salt-in-scram-hi
    label: >-
      VulnCheck Advisory: libstrophe through 0.14.0 Stack-Based Buffer Overflow
      via SCRAM Salt in SCRAM_Hi
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
  - exploit-available
epss: 0.00283
epssPercentile: 0.20745
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-19T19:37:54.956028Z'
ingestedAt: '2026-10-18T12:41:54.056Z'
---

## Overview

A flaw was found in libstrophe. A malicious XMPP (Extensible Messaging and Presence Protocol) server can exploit a stack-based buffer overflow in the SCRAM (Salted Challenge Response Authentication Mechanism) authentication handler by sending an oversized salt value. This issue allows an attacker to cause the client application to crash, resulting in a Denial of Service (DoS), or potentially corrupt stack memory.

## Vendor advisories

- **Red Hat VEX** · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112063.json)

**libstrophe: libstrophe: Denial of Service via oversized SCRAM salt**. Released 2026-10-18, updated 2026-10-21.

Not affected:

- All currently supported Red Hat products

## Remediation

Refer to the advisory for fix availability.