CVE-2019-1000007: Vulnerability in aioxmpp
Summary
CVE-2019-1000007: aioxmpp version 0.10.2 and earlier contains a Improper Handling of Structural Elements vulnerability in Stanza Parser, rollback during error processing, aioxmpp.xso.model.guard function that can result in Denial of Servi... Affects aioxmpp versions < 0.10.3. Fixed in 0.10.3. How to fix ↓
Also tracked for
- python-aioxmpp · Debian:11
The same CVE-2019-1000007 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aioxmpp is a Python library for XMPP (Extensible Messaging and Presence Protocol) communication. It provides functionality for creating and parsing XMPP stanzas. The library is commonly used in applications that require XMPP messaging capabilities. However, versions 0.10.2 and earlier of aioxmpp are vulnerable to an Improper Handling of Structural Elements vulnerability in the Stanza Parser. This vulnerability can be exploited remotely and may result in Denial of Service or data injection. The issue has been addressed in version 0.10.3.
Vulnerability Detail
The vulnerability in aioxmpp arises from an improper handling of structural elements in the Stanza Parser. When processing a crafted stanza, the aioxmpp.xso.model.guard function fails to properly handle errors and rollback, potentially leading to a Denial of Service or data injection. An attacker can send a specially crafted stanza to an application that uses the vulnerable components, causing the application to reconnect and potentially lose data. The vulnerability has been assigned the identifier CVE-2019-1000007 and the GHSA identifier GHSA-6m9g-jr8c-cqw3.
How To Fix
Latest published version: 0.13.3 as of 22 Oct 2026
pip install --upgrade "aioxmpp==0.13.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.10.3
This is the first release that contains the fix.
pip install --upgrade "aioxmpp==0.10.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the aioxmpp library as soon as possible.
Conclusion
The vulnerability in aioxmpp can be mitigated by upgrading to version 0.10.3 or later of the library. It is important for developers to promptly update their application's dependencies to ensure the security of their XMPP communication. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aioxmpp →
FAQ
aioxmpp is a Python library for XMPP communication, providing functionality for creating and parsing XMPP stanzas.
The vulnerability in aioxmpp can be exploited remotely and may result in Denial of Service or data injection. An attacker can send a specially crafted stanza to an application, potentially causing it to reconnect and lose data.
To fix the vulnerability, it is recommended to upgrade to version 0.10.3 or later of the aioxmpp library.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the aioxmpp library.
Yes, the vulnerability has been fixed in version 0.10.3 of the aioxmpp library.
References
Related vulnerabilities
Recent vulnerabilities recorded for aioxmpp.
