{"id":"CVE-2011-1755","aliases":["DEBIAN-CVE-2011-1755","EUVD-2011-1754","GHSA-rpcf-xw9j-7c7j","RHSA-2011:0881","RHSA-2011:0882"],"status":"published","title":"jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows...","description":"jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03659,"percentile":0.89694,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-776"],"published":"2011-06-21T01:00:00Z","modified":"2026-10-23T18:01:00Z","fixes":[{"ecosystem":"Debian:12","package":"jabberd2","fixed_in":["2.2.8-2.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jabberd2","fixed_in":["2.2.8-2.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jabberd2","fixed_in":["2.2.8-2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:network_proxy:5.4::el5","package":"jabberd","fixed_in":["0:2.2.8-12.el5sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_proxy:5.4::el5","package":"jabberd-debuginfo","fixed_in":["0:2.2.8-12.el5sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.4::el5","package":"jabberd","fixed_in":["0:2.2.8-12.el5sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.4::el5","package":"jabberd-debuginfo","fixed_in":["0:2.2.8-12.el5sat"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"jabberd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-2.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jabberd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-2.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jabberd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:network_proxy:5.4::el5","package":"jabberd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.8-12.el5sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_proxy:5.4::el5","package":"jabberd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.8-12.el5sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el5","package":"jabberd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.8-12.el5sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el5","package":"jabberd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.8-12.el5sat"}]}]}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"apple","product":"mac_os_x_server"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"jabberd2","product":"jabberd2"}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/67770","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://codex.xiaoka.com/svn/jabberd2/tags/jabberd-2.2.14/ChangeLog","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","web"]},{"url":"http://secunia.com/advisories/44957","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/44787","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Vendor Advisory","advisory"]},{"url":"http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","article"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061341.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","article"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-0881.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","web"]},{"url":"https://hermes.opensuse.org/messages/9197650","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=700390","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061458.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","article"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-0882.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","web"]},{"url":"http://www.securityfocus.com/bid/48250","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061482.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","article"]},{"url":"http://support.apple.com/kb/HT5002","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/45112","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://www.mail-archive.com/jabberd2%40lists.xiaoka.com/msg01655.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Release Notes","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-1755","tags":["advisory"]},{"url":"http://www.mail-archive.com/jabberd2@lists.xiaoka.com/msg01655.html"},{"url":"https://github.com/advisories/GHSA-rpcf-xw9j-7c7j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2011-1755","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2011:0881","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0881.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-1755","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-1755","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2011:0882","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0882.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2011-1755","description":"jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.","status":"published","published":"2011-06-21T01:00:00Z","modified":"2024-08-06T22:37:25.699Z","updated_at":"2026-11-02T14:35:38.711857Z"}],"euvd":[{"id":"EUVD-2011-1754","description":"jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.","status":"published","published":"2011-06-21T01:00:00Z","modified":"2024-08-06T22:37:25Z","updated_at":"2026-11-03T01:55:55.207376Z"}],"ghsa":[{"id":"GHSA-rpcf-xw9j-7c7j","title":"jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows...","description":"jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.","status":"published","published":"2022-05-17T01:59:37Z","modified":"2024-02-11T05:08:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T14:55:35.698137Z"}],"nvd":[{"id":"CVE-2011-1755","description":"jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.","status":"published","published":"2011-06-21T02:52:43.373Z","modified":"2026-06-16T23:29:57.863Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T14:02:08.47516Z"}],"osv":[{"id":"CVE-2011-1755","description":"jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.","status":"published","published":"2011-06-21T02:52:43Z","modified":"2026-04-10T03:41:46.401389Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:43:58.279353Z"},{"id":"DEBIAN-CVE-2011-1755","description":"jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.","status":"published","published":"2011-06-21T02:52:43.373Z","modified":"2026-10-23T18:01:00.617838746Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:24.612044Z"},{"id":"RHSA-2011:0881","title":"Red Hat Security Advisory: Red Hat Network Proxy server jabberd security update","status":"published","published":"2024-09-15T19:13:19Z","modified":"2025-11-22T10:31:57Z","updated_at":"2026-11-02T15:53:01.003286Z"},{"id":"RHSA-2011:0882","title":"Red Hat Security Advisory: Red Hat Network Satellite server jabberd security update","status":"published","published":"2024-09-15T19:13:23Z","modified":"2025-11-22T10:31:57Z","updated_at":"2026-11-02T15:53:01.003286Z"}]}}