CVE-2016-0756: Prosody

Medium severity, CVSS 5.3. EPSS: 2.1% chance of exploitation in the next 30 days.

The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix.

Affected products

• Prosody Prosody: up to and including 0.9.9

Published 2016-01-29. Last modified 2026-06-17.