CVE-2022-0217
prosody - security update
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).
- Record
CVE-2022-0217- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-776, CWE-611
- Updated
- 2026-11-02
CVE List No score
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).
- Record
CVE-2022-0217- Weakness
- CWE-776
- Updated
- 2026-11-02
EUVDEUVD-2022-15419 No score
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).
- Record
EUVD-2022-15419- Updated
- 2026-11-03
OSVALPINE-CVE-2022-0217
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).
- Record
ALPINE-CVE-2022-0217- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).
- Record
CVE-2022-0217- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-0217
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).
- Record
DEBIAN-CVE-2022-0217- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-0217
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).
- Record
UBUNTU-CVE-2022-0217- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2022:0012-1 No score
Security update for prosody
This update for prosody fixes the following issues:
Update to 0.11.12:
- CVE-2022-0217: util.xml: Do not allow doctypes, comments or processing instructions (bsc#1194596)
- Record
openSUSE-SU-2022:0012-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11736-1 No score
prosody-0.11.12-1.1 on GA media
These are all security issues fixed in the prosody-0.11.12-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11736-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
prosodyAlpine:v3.15 |
before 0.11.12-r0 | 0.11.12-r0 |
prosodyAlpine:v3.16 |
before 0.11.12-r0 | 0.11.12-r0 |
prosodyAlpine:v3.17 |
before 0.11.12-r0 | 0.11.12-r0 |
prosodyAlpine:v3.18 |
before 0.11.12-r0 | 0.11.12-r0 |
prosodyAlpine:v3.19 |
before 0.11.12-r0 | 0.11.12-r0 |
prosodyAlpine:v3.20 |
before 0.11.12-r0 | 0.11.12-r0 |
prosodyAlpine:v3.21 |
before 0.11.12-r0 | 0.11.12-r0 |
prosodyAlpine:v3.22 |
before 0.11.12-r0 | 0.11.12-r0 |
prosodyAlpine:v3.23 |
before 0.11.12-r0 | 0.11.12-r0 |
prosodyAlpine:v3.24 |
before 0.11.12-r0 | 0.11.12-r0 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
prosodyDebian:12 |
before 0.11.12-1 | 0.11.12-1 |
prosodyDebian:13 |
before 0.11.12-1 | 0.11.12-1 |
prosodyDebian:14 |
before 0.11.12-1 | 0.11.12-1 |
prosodyDebian:10 |
before 0.11.2-1+deb10u3, plus listed versions 0.11.2-10.11.2-1+deb10u10.11.2-1+deb10u2 |
0.11.2-1+deb10u3 |
prosodyDebian:11 |
before 0.11.9-2+deb11u1, plus listed versions 0.11.9-2 |
0.11.9-2+deb11u1 |
prosodyUbuntu:16.04:LTS |
All versions, plus listed versions 0.9.8-10.9.9-10.9.10-1 |
None known |
prosodyUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.9.12-20.10.0-10.10.0-1build10.10.0-1ubuntu0.1~esm1 |
None known |
prosodyUbuntu:20.04:LTS |
All versions, plus listed versions 0.11.2-10.11.3-10.11.4-1 |
None known |
prosodyUbuntu:22.04:LTS |
All versions, plus listed versions 0.11.10-10.11.10-1build10.11.10-1build20.11.11-10.11.11-20.11.12-10.11.13-1 |
None known |
prosodyUbuntu:24.04:LTS |
All versions, plus listed versions 0.12.3-10.12.4-10.12.4-1build10.12.4-1build20.12.4-1build3 |
None known |
prosodyUbuntu:25.10 |
All versions, plus listed versions 0.12.5-1build113.0.1-1 |
None known |
prosodyUbuntu:26.10 |
All versions, plus listed versions 13.0.4-213.0.5-113.0.6-113.0.6-1build1 |
None known |
prosodyUbuntu:26.04:LTS |
All versions, plus listed versions 13.0.1-113.0.2-113.0.2-1build113.0.3-113.0.4-113.0.4-2 |
None known |
prosodySUSE:Package Hub 15 SP3 |
before 0.11.12-bp153.2.12.1 | 0.11.12-bp153.2.12.1 |
prosodyopenSUSE:Leap 15.3 |
before 0.11.12-bp153.2.12.1 | 0.11.12-bp153.2.12.1 |
prosodyopenSUSE:Tumbleweed |
before 0.11.12-1.1 | 0.11.12-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-0217 is a high vulnerability (CVSS 7.5) in Prosody, published January 14, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.53%, the 92nd percentile. Fixed in prosody 0.11.12-r0.