CVE-2014-2744

plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack.

• CWE-20

• http://blog.prosody.im/prosody-0-9-4-released/Vendor Advisory
• http://code.lightwitch.org/metronome/rev/49f47277a411Exploit, Patch
• http://hg.prosody.im/0.9/rev/b3b1c9da38fbExploit, Patch
• http://openwall.com/lists/oss-security/2014/04/07/7
• http://openwall.com/lists/oss-security/2014/04/09/1
• http://secunia.com/advisories/57710
• http://www.debian.org/security/2014/dsa-2895
• http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/
• http://blog.prosody.im/prosody-0-9-4-released/Vendor Advisory
• http://code.lightwitch.org/metronome/rev/49f47277a411Exploit, Patch
• http://hg.prosody.im/0.9/rev/b3b1c9da38fbExploit, Patch
• http://openwall.com/lists/oss-security/2014/04/07/7
• http://openwall.com/lists/oss-security/2014/04/09/1
• http://secunia.com/advisories/57710
• http://www.debian.org/security/2014/dsa-2895
• http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/

Published

Apr 11, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-2736Multiple SQL injection vulnerabilities in MODX Revolution be…
• CVE-2014-2737SQL injection vulnerability in the get_active_session functi…
• CVE-2014-2739The cma_req_handler function in drivers/infiniband/core/cma.…
• CVE-2014-2741nio/XMLLightweightParser.java in Ignite Realtime Openfire be…
• CVE-2014-2742Isode M-Link before 16.0v7 does not properly restrict the pr…
• CVE-2014-2743plugins/mod_compression.lua in Lightwitch Metronome through …
• CVE-2014-2745Prosody before 0.9.4 does not properly restrict the processi…
• CVE-2014-2746net/IOService.java in Tigase before 5.2.1 does not properly …
• CVE-2014-2748The Security Audit Log facility in SAP Enhancement Package (…
• CVE-2014-2749The HANA ICM process in SAP HANA allows remote attackers to …
• CVE-2014-2750Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-2751SAP Print and Output Management has hardcoded credentials, w…