CVE-2026-43505

Published: May 1, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Exploitability: 3.9 / Impact: 2.5

Source: MITRE (Secondary)

Description

An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in the activation scenario, relaying of unauthenticated traffic can occur.

Affected (2)

Products: Prosody: Prosody

Prosody

1 product

Prosody

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Prosody Prosody	Before 0.12.6
Prosody Prosody	From 13.0.0 to 13.0.5

Related CWEs

CWE-420

Unprotected Alternate Channel

The product protects a primary channel, but it does not use the same level of protection for an alternate channel.

References (2)

https://prosody.im/security/advisory_735dd9d3/

Source: cve@mitre.org

MitigationPatchVendor Advisory

https://www.openwall.com/lists/oss-security/2026/05/01/5

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

Timeline

No history available yet.