Prosody before version 0.12.6 and 13.0.5 contains a memory leak that can be exploited by an unauthenticated attacker. Repeated connections drain memory until the server becomes unresponsive or must be restarted, thereby denying service to legitimate users. The vulnerability does not allow code execution or data exposure, but disrupts service availability.

Any installation of Prosody, including the main branch and the release branch X (1.0.0 through 13.0.0 before 13.0.5), that is deployed before 0.12.6 or 13.0.5 is affected. Providers running those versions without authentication enabled on XMPP services are at risk.

The assigned CVSS score of 5.3 indicates moderate severity. The EPSS value is not available, so the current exploitation probability is not quantified, but the description shows the threat can be triggered by unauthenticated network connections, meaning an attacker only needs network access. The vulnerability is not listed in the CISA KEV catalog, which suggests no known exploitation activity yet, yet the memory exhaustion vector can quickly overwhelm a server and interrupt service.