CVE-2024-46957

9.8 criticalEPSS 0.6%

Critical (9.8). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in mellium.im/xmpp 0.22.0.

Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is not checked. This is fixed in 0.22.0.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-290
Published: 2024-09-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-98hf-m87w-cq6h	Go	mellium.im/xmpp	<0.22.0	0.22.0
GO-2024-3157	Go	mellium.im/xmpp	<0.22.0	0.22.0

References

https://codeberg.org/mellium/xmpp/releases
https://mellium.im/cve/cve-2024-46957/

Check your stack JSON