{"action":"Upgrade org.igniterealtime.openfire:xmppserver to 5.0.2 or later.","affected":[{"fixed":"5.0.2","introduced":"0"}],"component":"org.igniterealtime.openfire:xmppserver","cve_ids":["CVE-2025-59154"],"ecosystem":"Maven","epss":0.00234,"exploited":false,"fixed_versions":["5.0.2"],"ghsa_id":"GHSA-w252-645g-87mp","id":"tcs_01M5N9F459WQWXVAV2K54178RF","modified_at":"2025-09-16T02:29:44.549143Z","published_at":"2025-09-16T01:54:24Z","references":["https://osv.dev/vulnerability/GHSA-w252-645g-87mp","https://github.com/igniterealtime/Openfire/security/advisories/GHSA-w252-645g-87mp","https://nvd.nist.gov/vuln/detail/CVE-2025-59154","https://github.com/igniterealtime/Openfire","https://github.com/igniterealtime/Openfire/blob/8d073dda36905da0fdee7cb623c025a01a5cbf6b/xmppserver/src/main/java/org/jivesoftware/util/cert/CNCertificateIdentityMapping.java#L43","https://igniterealtime.atlassian.net/browse/OF-3122","https://igniterealtime.atlassian.net/browse/OF-3123","https://igniterealtime.atlassian.net/browse/OF-3124"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-w252-645g-87mp","url":"https://osv.dev/vulnerability/GHSA-w252-645g-87mp"}],"summary":"Openfire has potential identity spoofing issue via unsafe CN parsing"}