CVE-2022-24968: Mellium Xmpp

Medium severity, CVSS 5.9. EPSS: 0.5% chance of exploitation in the next 30 days.

In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification.

Affected products

• Mellium Xmpp: from 0.18.0, before 0.21.1 (fixed in 0.21.1)

Published 2022-02-11. Last modified 2026-06-17.