{"id":"DEBIAN-CVE-2026-112063","details":"libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, aborting the client or overwriting stack memory in NDEBUG builds.","modified":"2026-10-19T05:00:07.390485363Z","published":"2026-10-18T20:47:34.677713851Z","upstream":["CVE-2026-112063"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-112063"}],"affected":[{"package":{"name":"libstrophe","ecosystem":"Debian:12","purl":"pkg:deb/debian/libstrophe?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.2-1","0.12.3-1","0.12.3-1~bpo12+1","0.13.0-1","0.13.0-1~bpo11+1","0.13.0-1~bpo12+1","0.13.1-1","0.14.0-1","0.14.0-2","0.14.0-3","0.14.0-4","0.14.0-4~bpo12+1","0.14.0-5"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-112063.json"}},{"package":{"name":"libstrophe","ecosystem":"Debian:13","purl":"pkg:deb/debian/libstrophe?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14.0-4","0.14.0-5"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-112063.json"}},{"package":{"name":"libstrophe","ecosystem":"Debian:14","purl":"pkg:deb/debian/libstrophe?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14.0-4","0.14.0-5"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-112063.json"}}],"schema_version":"1.9.0"}