In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| mellium.im/xmpp(Go) | 0.18.0 | 0.21.1 | N/A |
CVSS Metrics
