CVE-2014-2829

Published: Apr 11, 2014Modified: May 6, 2026

7.8

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability: 10.0 / Impact: 6.9

Source: NVD

Description

Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.

Affected (5)

Products: Erlang Solutions: Mongooseim

Erlang Solutions

1 product

Mongooseim

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Erlang Solutions Mongooseim	version ≤ 1.3.1
Erlang Solutions Mongooseim	Version 1.2.1
Erlang Solutions Mongooseim	Version 1.2.2
Erlang Solutions Mongooseim	Version 1.3.0
Erlang Solutions Mongooseim	Version 1.3.1

Related CWEs

CWE-264

References (4)

http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/

Source: cve@mitre.org

https://github.com/esl/MongooseIM/commit/586d96cc12ef218243a3466354b4d208b5472a6c

Source: cve@mitre.org

ExploitPatch

http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/esl/MongooseIM/commit/586d96cc12ef218243a3466354b4d208b5472a6c

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

Timeline

No history available yet.