Bug 2554781 (CVE-2026-112063) - CVE-2026-112063 libstrophe: libstrophe: Denial of Service via oversized SCRAM salt
Summary: CVE-2026-112063 libstrophe: libstrophe: Denial of Service via oversized SCRAM...
Keywords:
Status: NEW
Alias: CVE-2026-112063
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2558156 2558157
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-18 12:41 UTC by OSIDB Bzimport
Modified: 2026-10-21 08:50 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-18 12:41:32 UTC 
libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, aborting the client or overwriting stack memory in NDEBUG builds.
Note You need to log in before you can comment on or make changes to this bug.