The vulnerability is an unbounded allocation error in XML parsing within Apache Vysper, an XMPP server library. The unchecked allocation can cause the process to run out of memory when handling large or malformed XML payloads, potentially crashing the server and denying service. The weakness, identified as uncontrolled memory allocation, exposes the application to resource exhaustion attacks rather than direct code execution.

All current and legacy versions of Apache Vysper, an XMPP (Jabber) server library supplied by the Apache Software Foundation, are affected. No version has a released fix, and the project is retired.

With a CVSS score of 7.5, the vulnerability represents a moderate to high severity risk. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote: an adversary can send a large or specially crafted XML payload over the XMPP protocol to trigger excessive memory allocation and trigger a crash or memory exhaustion. Because the fix is not forthcoming, the risk remains persistent until the application is replaced or mitigated through external controls.