CVE-2021-32919: An issue was discovered in Prosody before 0.11.9.

Security readout for executives and security teams

Prosody XMPP servers before 0.11.9 have a certificate authentication flaw only when the undocumented dialback_without_dialback option is enabled. A remote server could impersonate another server, undermining trust between federated XMPP domains. Exposure is likely limited to organizations running Prosody before 0.11.9 with dialback_without_dialback enabled. The option is described as undocumented and experimental, so default exposure may be narrower than normal Prosody deployments, but configuration must be verified. Prioritize remediation for externally federated Prosody servers, especially where custom or experimental authentication options may be enabled. Treat as a trust-boundary issue rather than a broad internet-wide emergency. Mitigation focus: Upgrade Prosody to 0.11.9 or a vendor-fixed package.; Disable dialback_without_dialback unless vendor guidance explicitly requires it.; Apply Debian, Fedora, Gentoo, or distribution security updates where applicable..

Prepared

Jun 3, 2026, 02:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.