CVE-2017-5591: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacke...

Security readout for executives and security teams

This flaw can make a vulnerable XMPP chat client display a message as if it came from another user, including a trusted contact. The main business risk is social engineering: users may trust instructions, links, or requests that appear to come from someone else. The provided sources do not show CISA KEV listing or confirmed active exploitation. Exposure is likely limited to XMPP clients or applications using SleekXMPP through 1.3.1, Slixmpp through 1.2.3, or poezio 0.8 through 0.10. Products bundling these libraries may also be affected, but the provided data does not enumerate them. Prioritize remediation where XMPP is used for operational, administrative, or customer-facing communication. The issue can support convincing impersonation, but supplied evidence does not indicate active exploitation or direct system compromise. Mitigation focus: Inventory XMPP clients and applications using SleekXMPP, Slixmpp, or poezio.; Upgrade affected components beyond the listed vulnerable versions where vendor releases exist.; Review the cited Slixmpp fix commit when validating packaged or forked versions..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.