CVE-2014-8760: ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which cause...

Security readout for executives and security teams

CVE-2014-8760 is an ejabberd encryption enforcement flaw. In versions before 2.1.13, using compression could bypass the starttls_required setting, allowing clients to connect without encryption. This mainly creates confidentiality and compliance risk for XMPP messaging environments that expected encrypted client connections. Exposure is limited to organizations running ejabberd before 2.1.13 with STARTTLS required and compression enabled or available. Internet-facing or partner-facing XMPP services have higher confidentiality exposure. The provided sources do not identify broader product impact beyond ejabberd. Prioritize remediation where ejabberd handles sensitive internal, customer, or regulated communications. This is not presented as actively exploited, but it can undermine an explicit encryption requirement and create avoidable data exposure risk. Mitigation focus: Upgrade ejabberd to 2.1.13 or a vendor-patched package.; Apply relevant distribution advisories, including Mageia or Mandriva where applicable.; Review vendor guidance for interim handling of compression if immediate upgrade is not possible..

Prepared

Jun 14, 2026, 07:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.