CVE-2026-112063

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112063
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112063.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112063
Downstream
Published
2026-10-18T12:19:52Z
Modified
2026-10-19T02:45:47Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
libstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM_Hi
Details

libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, aborting the client or overwriting stack memory in NDEBUG builds.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-121"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112063.json"
}
References

Affected packages

Git / github.com/strophe/libstrophe

Affected ranges

Type
GIT
Repo
https://github.com/strophe/libstrophe
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
7c2e78937d1f8614339bfa88bdcc21bb406deadd
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "0.14.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*
0.10.0
0.10.1
0.11.0
0.12.0
0.12.1
0.12.2
0.12.3
0.13.0
0.13.1
0.14.0
0.8.5
0.8.6
0.8.7
0.8.8
0.9.0
0.9.1
0.9.2
0.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112063.json"