prosody - Debian Package Tracker

general

source: prosody (main)
version: 13.0.5-1
maintainer: Debian XMPP Maintainers (archive) (DMD)
uploaders: Sergei Golovan [DMD] – Matthew James Wild [DMD] – Victor Seva [DMD]
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.11.9-2+deb11u2
o-o-sec: 0.11.9-2+deb11u2
oldstable: 0.12.3-1
old-bpo: 13.0.1-1~bpo12+1
stable: 13.0.1-1
stable-bpo: 13.0.4-2~bpo13+1
testing: 13.0.4-2
unstable: 13.0.5-1

versioned links

0.11.9-2+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.12.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
13.0.1-1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
13.0.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
13.0.4-2~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
13.0.4-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
13.0.5-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

prosody (10 bugs: 0, 6, 4, 0)

action needed

4 security issues in trixie high

There are 4 open security issues in trixie.

4 important issues:

CVE-2026-43504: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in a paused scenario, relaying of unauthenticated traffic can occur.
CVE-2026-43505: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in the activation scenario, relaying of unauthenticated traffic can occur.
CVE-2026-43506: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by memory leaks from unauthenticated connections.
CVE-2026-43507: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by XML parsing resource amplification from unauthenticated connections.

Created: 2026-05-01 Last update: 2026-05-02 07:00

4 security issues in forky high

There are 4 open security issues in forky.

4 important issues:

CVE-2026-43504: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in a paused scenario, relaying of unauthenticated traffic can occur.
CVE-2026-43505: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in the activation scenario, relaying of unauthenticated traffic can occur.
CVE-2026-43506: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by memory leaks from unauthenticated connections.
CVE-2026-43507: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by XML parsing resource amplification from unauthenticated connections.

Created: 2026-05-01 Last update: 2026-05-02 07:00

4 security issues in bullseye high

There are 4 open security issues in bullseye.

4 important issues:

CVE-2026-43504: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in a paused scenario, relaying of unauthenticated traffic can occur.
CVE-2026-43505: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in the activation scenario, relaying of unauthenticated traffic can occur.
CVE-2026-43506: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by memory leaks from unauthenticated connections.
CVE-2026-43507: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by XML parsing resource amplification from unauthenticated connections.

Created: 2026-05-01 Last update: 2026-05-02 07:00

4 security issues in bookworm high

There are 4 open security issues in bookworm.

4 important issues:

CVE-2026-43504: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in a paused scenario, relaying of unauthenticated traffic can occur.
CVE-2026-43505: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in the activation scenario, relaying of unauthenticated traffic can occur.
CVE-2026-43506: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by memory leaks from unauthenticated connections.
CVE-2026-43507: An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by XML parsing resource amplification from unauthenticated connections.

Created: 2026-05-01 Last update: 2026-05-02 07:00

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2026-05-02 Last update: 2026-05-04 22:31

1 open merge request in Salsa normal

There is 1 open merge request for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2026-05-04 Last update: 2026-05-04 18:32

lintian reports 2 warnings normal

Lintian reports 2 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-03-03 Last update: 2026-03-18 14:01

debian/patches: 3 patches to forward upstream low

Among the 3 debian patches available in version 13.0.5-1 of the package, we noticed the following issues:

3 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-05-01 22:02

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migration status for prosody (13.0.4-2 to 13.0.5-1): Waiting for test results or another package, or too young (no action required now - check later)
- Issues preventing migration:
- ∙ ∙ Autopkgtest for libervia-pubsub/0.5.0~hg494-3: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, i386: No tests, superficial or marked flaky ♻, ppc64el: No tests, superficial or marked flaky ♻, riscv64: No tests, superficial or marked flaky ♻, s390x: Test triggered
- ∙ ∙ Too young, only 4 of 5 days old
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/p/prosody.html
- ∙ ∙ Reproduced on amd64
- ∙ ∙ Reproduced on arm64
- ∙ ∙ Reproduced on armhf
- ∙ ∙ Reproduced on i386
- ∙ ∙ Reproducibility check waiting for results on ppc64el
- Not considered

news

[rss feed]

[2026-05-01] Accepted prosody 13.0.5-1 (source) into unstable (Victor Seva)
[2026-03-08] Accepted prosody 13.0.4-2~bpo13+1 (source amd64) into stable-backports (Debian FTP Masters) (signed by: Martin)
[2026-02-12] prosody 13.0.4-2 MIGRATED to testing (Debian testing watch)
[2026-02-06] Accepted prosody 13.0.4-2 (source) into unstable (Victor Seva)
[2026-01-26] Accepted prosody 13.0.4-1 (source) into unstable (Victor Seva)
[2026-01-13] Accepted prosody 13.0.3-1 (source) into unstable (Victor Seva)
[2025-09-10] prosody 13.0.2-1 MIGRATED to testing (Debian testing watch)
[2025-09-03] Accepted prosody 13.0.2-1 (source) into unstable (Victor Seva)
[2025-04-09] Accepted prosody 13.0.1-1~bpo12+1 (source) into stable-backports (Martin)
[2025-04-09] prosody 13.0.1-1 MIGRATED to testing (Debian testing watch)
[2025-04-04] Accepted prosody 13.0.1-1 (source) into unstable (Martin)
[2025-03-24] Accepted prosody 13.0.0-1~bpo12+1 (source) into stable-backports (Martin)
[2025-03-24] prosody 13.0.0-1 MIGRATED to testing (Debian testing watch)
[2025-03-18] Accepted prosody 13.0.0-1 (source) into unstable (Martin)
[2025-01-09] Accepted prosody 0.12.5-1~bpo12+1 (source) into stable-backports (Martin)
[2025-01-09] prosody 0.12.5-1 MIGRATED to testing (Debian testing watch)
[2025-01-04] Accepted prosody 0.12.5-1 (source) into unstable (Victor Seva)
[2024-11-10] prosody 0.12.4-2 MIGRATED to testing (Debian testing watch)
[2024-11-05] Accepted prosody 0.12.4-2 (source) into unstable (Victor Seva)
[2023-10-02] Accepted prosody 0.12.4-1~bpo12+1 (source amd64) into stable-backports (Debian FTP Masters) (signed by: W. Martin Borgert)
[2023-09-18] prosody 0.12.4-1 MIGRATED to testing (Debian testing watch)
[2023-09-13] Accepted prosody 0.12.4-1 (source) into unstable (Victor Seva)
[2023-03-04] Accepted prosody 0.12.3-1~bpo11+1 (source) into bullseye-backports (Martin) (signed by: W. Martin Borgert)
[2023-03-04] prosody 0.12.3-1 MIGRATED to testing (Debian testing watch)
[2023-02-22] Accepted prosody 0.12.3-1 (source) into unstable (Victor Seva)
[2023-02-01] prosody 0.12.2-2 MIGRATED to testing (Debian testing watch)
[2023-01-22] Accepted prosody 0.12.2-2 (source) into unstable (Victor Seva)
[2023-01-20] Accepted prosody 0.12.2-1~bpo11+1 (source) into bullseye-backports (Martin) (signed by: W. Martin Borgert)
[2023-01-16] prosody 0.12.2-1 MIGRATED to testing (Debian testing watch)
[2023-01-10] Accepted prosody 0.12.2-1 (source) into unstable (Victor Seva)

bugs [bug history graph]

all: 9 10
RC: 0
I&N: 6
M&W: 3 4
F&P: 0
patch: 0

links

homepage
lintian (0, 2)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 13.0.4-2
5 bugs (1 patch)