Critical severity9.8GHSA Advisory· Published Sep 25, 2024· Updated Apr 15, 2026

CVE-2024-46957

Description

Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is not checked. This is fixed in 0.22.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
mellium.im/xmppGo	< 0.22.0	0.22.0

Affected products

GO/XmppGHSA
Range: < 0.22.0
ghsa-coords
pkg:golang/mellium.im/xmpp
Range: < 0.22.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-98hf-m87w-cq6hghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-46957ghsaADVISORY
codeberg.org/mellium/xmpp/releasesnvdWEB
codeberg.org/mellium/xmpp/releases/tag/v0.22.0ghsaWEB
mellium.im/cve/cve-2024-46957ghsaWEB
mellium.im/cve/cve-2024-46957/nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000