CVE-2021-32918: An issue was discovered in Prosody before 0.11.9.

Security readout for executives and security teams

Prosody XMPP servers before 0.11.9 can be remotely crashed or exhausted without authentication in some default deployments. The known impact is service availability, not data theft or code execution, and it specifically depends on running under Lua 5.2 or Lua 5.3. Exposure is most likely for organizations operating Prosody XMPP servers earlier than 0.11.9, especially internet-reachable servers using Lua 5.2 or Lua 5.3 with default settings. Prioritize remediation for internet-facing Prosody servers because unauthenticated availability loss can disrupt messaging services. This is not documented as data compromise or active exploitation in the supplied sources. Mitigation focus: Upgrade Prosody to 0.11.9 or later.; Apply relevant Debian, Fedora, or Gentoo security package updates.; Verify the deployed Lua runtime version on Prosody hosts..

Prepared

Jun 3, 2026, 02:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.