CVE-2021-32921: An issue was discovered in Prosody before 0.11.9.

Security readout for executives and security teams

Prosody before 0.11.9 could leak secret values through tiny timing differences when comparing certain secrets under Lua 5.2 or later. This is not a simple crash or takeover issue, but leaked secrets could undermine authentication or trust boundaries depending on what the deployment uses Prosody for. Exposure is most likely in environments running Prosody XMPP server before 0.11.9, especially installations using Lua 5.2 or later. Debian, Fedora, and Gentoo advisories indicate packaged Prosody deployments required security updates. Treat as a targeted confidentiality risk, not an emergency based on provided evidence. Prioritize remediation where Prosody is internet-facing, handles sensitive authentication, or remains below version 0.11.9. Mitigation focus: Upgrade Prosody to 0.11.9 or later.; Apply distribution security updates for Prosody packages.; Review Debian LTS regression advisory before relying on old update states..

Prepared

Jun 3, 2026, 02:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.