{"cve":"CVE-2019-1000007","nvd":{"published":"2019-02-04T21:29:00.877","modified":"2026-06-17T02:09:24.450","status":"Modified","description":"aioxmpp version 0.10.2 and earlier contains a Improper Handling of Structural Elements vulnerability in Stanza Parser, rollback during error processing, aioxmpp.xso.model.guard function that can result in Denial of Service, Other. This attack appears to be exploitable via Remote. A crafted stanza can be sent to an application which uses the vulnerable components to either inject data in a different context or cause the application to reconnect (potentially losing data). This vulnerability appears to have been fixed in 0.10.3.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","score":7.4},"cwes":[],"references":["https://github.com/horazont/aioxmpp/pull/268","https://github.com/horazont/aioxmpp/pull/268"],"products":["aioxmpp_project:aioxmpp"],"source":"nvd","synced_at":"2026-10-19T20:54:46.948512734+00:00"},"epss":{"cve":"CVE-2019-1000007","score":0.0117,"percentile":0.67424,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-6m9g-jr8c-cqw3","url":"https://osv.dev/vulnerability/GHSA-6m9g-jr8c-cqw3","summary":"Depth counting error in guard() leading to multiple potential security issues in aioxmpp","modified":"2024-09-04T20:04:41.882014Z","packages":[{"ecosystem":"PyPI","name":"aioxmpp","purl":"pkg:pypi/aioxmpp","ranges":["<0.10.3"],"fixed":["0.10.3"]}]},{"id":"PYSEC-2019-1","url":"https://osv.dev/vulnerability/PYSEC-2019-1","summary":"","modified":"2023-11-08T04:00:35.411338Z","packages":[{"ecosystem":"PyPI","name":"aioxmpp","purl":"pkg:pypi/aioxmpp","ranges":["<0.10.3"],"fixed":["0.10.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}