CVE-2016-0756

The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix.

• CWE-20

• http://blog.prosody.im/prosody-0-9-10-released/Patch, Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176796.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176914.html
• http://www.debian.org/security/2016/dsa-3463
• http://www.openwall.com/lists/oss-security/2016/01/27/10
• http://www.securityfocus.com/bid/82241
• https://prosody.im/issues/issue/596
• https://prosody.im/security/advisory_20160127/Vendor Advisory
• http://blog.prosody.im/prosody-0-9-10-released/Patch, Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176796.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176914.html
• http://www.debian.org/security/2016/dsa-3463
• http://www.openwall.com/lists/oss-security/2016/01/27/10
• http://www.securityfocus.com/bid/82241
• https://prosody.im/issues/issue/596
• https://prosody.im/security/advisory_20160127/Vendor Advisory

Published

Jan 29, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-0750The hotrod java client in infinispan before 9.1.0.Final auto…4.2
• CVE-2016-0751actionpack/lib/action_dispatch/http/mime_type.rb in Action P…
• CVE-2016-0752Directory traversal vulnerability in Action View in Ruby on …7.5
• CVE-2016-0753Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x b…5.3
• CVE-2016-0754cURL before 7.47.0 on Windows allows attackers to write to a…
• CVE-2016-0755The ConnectionExists function in lib/url.c in libcurl before…
• CVE-2016-0757OpenStack Image Service (Glance) before 2015.1.3 (kilo) and …
• CVE-2016-0758Integer overflow in lib/asn1_decoder.c in the Linux kernel b…7.8
• CVE-2016-0759Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-0760Multiple incomplete blacklist vulnerabilities in Apache Sent…
• CVE-2016-0761Cloud Foundry Garden-Linux versions prior to v0.333.0 and El…9.8
• CVE-2016-0762The Realm implementations in Apache Tomcat versions 9.0.0.M1…5.9