CVE-2021-32917: Debian Linux

Medium severity, CVSS 5.3. EPSS: 2.2% chance of exploitation in the next 30 days.

An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server's bandwidth.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 32 only; version 33 only; version 34 only
• Prosody Prosody: before 0.11.9 (fixed in 0.11.9)

Published 2021-05-13. Last modified 2026-06-17.