← Vulnerability feed

Vulnerability record · CVE-2014-2744 · published 11 April 2014

CVE-2014-2744: Lightwitch metronome improper input validation vulnerability

Lightwitch · Metronome

plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack.

7.8 CVSS 2.0 High EPSS 3.3% · top 11.9% CWE-20 · Improper input validation
7.8CVSS 2.0 base score
3.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
16References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack.

AV:N/AC:L/Au:N/C:N/I:N/A:C

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://blog.prosody.im/prosody-0-9-4-released/ Vendor Advisory
http://code.lightwitch.org/metronome/rev/49f47277a411 ExploitPatch
http://hg.prosody.im/0.9/rev/b3b1c9da38fb ExploitPatch
http://openwall.com/lists/oss-security/2014/04/07/7
http://openwall.com/lists/oss-security/2014/04/09/1
http://secunia.com/advisories/57710
http://www.debian.org/security/2014/dsa-2895
http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/
http://blog.prosody.im/prosody-0-9-4-released/ Vendor Advisory
http://code.lightwitch.org/metronome/rev/49f47277a411 ExploitPatch
http://hg.prosody.im/0.9/rev/b3b1c9da38fb ExploitPatch
http://openwall.com/lists/oss-security/2014/04/07/7
http://openwall.com/lists/oss-security/2014/04/09/1
http://secunia.com/advisories/57710
http://www.debian.org/security/2014/dsa-2895
http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/

Track CVE-2014-2744 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2018-10847Prosody improper authentication vulnerabilityprosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user…EPSS 1.7%7.8CVE-2014-2743Lightwitch metronome permissions and access controls vulnerabilityplugins/mod_compression.lua in Lightwitch Metronome through 3.4 does not properly restrict the processing of compressed XML elements, which allows re…EPSS 1.9%7.8CVE-2014-2745Prosody permissions and access controls vulnerabilityProsody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service…EPSS 3.1%7.5CVE-2026-43506Prosody memory leak vulnerabilityAn issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused b…EPSS 0.49%7.5CVE-2026-43507Prosody allocation without limits vulnerabilityAn issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused b…EPSS 0.64%7.5CVE-2022-0217Prosody xml external entity (xxe) vulnerabilityIt was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML da…EPSS 5.4%7.5CVE-2021-37601Prosody vulnerabilitymuc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned ent…EPSS 2.3%7.5CVE-2021-32918Prosody uncontrolled resource consumption vulnerabilityAn issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memo…EPSS 2.1%

Source: NIST National Vulnerability Database (record CVE-2014-2744), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.