Fedora 43 Prosody 13.0.5 Critical Security Advisory 2026-36c53b9ca8

Prosody is a flexible communications server for Jabber/XMPP written in Lua.

It aims to be easy to use, and light on resources. For developers it aims

to be easy to extend and give a flexible system on which to rapidly develop

added functionality, or prototype new protocols.

Prosody 13.0.5 Upstream is pleased to announce a new minor release from their stable branch. This is a security release for the Prosody 13.0.x stable series. It fixes multiple security issues, some memory leaks and some smaller bugs and changes which have been implemented since the previous release. Full details about the security vulnerabilities can be found in upstream's security advisory. Upstream encourages all Prosody operators on 13.0.4 or earlier to upgrade to 13.0.5 as soon as possible, or to review the advisory and implement appropriate mitigations. A summary of changes in this release: Security mod_proxy65: Consistently apply authorization checks mod_proxy65: Don\u2019t proxy data until after bytestream activation mod_c2s, mod_s2s: Introduce new pre-authentication stanza size limit Add limit for stanza max child elements mod_c2s: Remove timers immediately on disconnection net.server_epoll: Clean up timers after disconnection Fixes and improvements net.http.parser: Fix hand...