The vulnerability is a denial‑of‑service caused by memory exhaustion during XML parsing. An unauthenticated client can send crafted XML that triggers Prosody to allocate excessive memory, ultimately leading to a crash or prolonged unresponsive state. This failure results in a loss of service for all clients connected to the affected server.

The flaw affects all installations of Prosody before version 0.12.6, releases 1.0.0 through 13.0.0 before 13.0.5, or any earlier baseline. For instance, Prosody 0.11.x, 0.12.0‑0.12.5, 1.0.0‑13.0.4, and 13.0.0‑13.0.4 are susceptible.

The CVSS score of 5.3 denotes moderate severity, yet the vulnerability can be triggered merely via an unauthenticated connection, making it a potential remote denial‑of‑service vector. The EPSS score is not available, so the probability of exploitation remains indeterminate. The issue is not listed in the CISA KEV catalog. An attacker can flood the server with XML requests, exhausting memory and causing service outage. Mitigation requires applying the vendor’s fix or reducing the server’s exposure to untrusted XML input.