CVE-2014-0364: Ignite Realtime Smack

Medium severity, CVSS 5.0. EPSS: 6.2% chance of exploitation in the next 30 days.

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute.

Affected products

• Ignite Realtime Smack: before 4.0.0 (fixed in 4.0.0)

Published 2014-04-30. Last modified 2026-06-17.