CVE-2014-2829
Erlang Solutions MongooseIM vulnerable to denial of service (DoS) via crafted XMPP stream
Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
Exploit likelihood
What each source reports
NVD Score used
Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
- Record
CVE-2014-2829- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
- Record
CVE-2014-2829- Updated
- 2026-11-02
EUVDEUVD-2022-2659 No score
Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
- Record
EUVD-2022-2659- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5v5w-44w6-q5hv
Erlang Solutions MongooseIM vulnerable to denial of service (DoS) via crafted XMPP stream
Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
- Record
GHSA-5v5w-44w6-q5hv- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-5v5w-44w6-q5hv
Erlang Solutions MongooseIM vulnerable to denial of service (DoS) via crafted XMPP stream
Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
- Record
GHSA-5v5w-44w6-q5hv- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-770
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
MongooseIMHex |
through 1.3.1 | 1.3.2 |
MongooseIMHex |
before 1.3.2 | 1.3.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-2829 is a high vulnerability (CVSS 7.8) in Erlang-solutions Mongooseim, published April 11, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.01%, the 80th percentile. Fixed in MongooseIM 1.3.2.