Junglewise Threat Intelligence

GO-2022-0947 - In Mellium mellium.im/xmpp, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under th

Severity: info · Published 2022-08-22

Technologies: mellium.im/xmpp (Go). Vendors: Go.

Executive brief

In Mellium mellium.im/xmpp, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during verification.

Affected products

  • Go mellium.im/xmpp

Related threats