# Uncontrolled Resource Consumption with XMPP-Layer Compression

XMPP servers decompressing application-layer zlib stanzas without size limits allow a 4MB compressed 'xmppbomb' to expand to 4GB, exhausting CPU/memory and causing DoS.

- Payout: $500
- Severity: high
- Program: Internet Bug Bounty
- Credited: gianko
- Disclosed: 2014-04-20
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/5928
- Library page: https://bugbountylibrary.com/r/h1%3A5928
- Tags: domain:network impact:dos kind:bounty platform:hackerone sev:high technique:recon technique:source-review vuln:dos

**Target:** XMPP server stream compression (XEP-0138 zlib)
**Root cause:** Servers decompress XMPP stanzas without limiting allocated resources, so a highly-compressed XML element with gigabytes of whitespace expands unbounded in memory/CPU.
**Steps:**
1. Prepare offline a 4MB zlib-compressed XML stream element containing ~4GB of spaces (`$SPACES`)
2. Open XMPP stream: `<?xml version='1.0'?><stream:stream to='server' xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' version='1.0'>`
3. Request compression: `<compress xmlns='http://jabber.org/protocol/compress'><method>zlib</method></compress>`
4. Send the xmppbomb; for post-auth variant first send `<auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='PLAIN'>$TOKEN</auth>`
5. Observe CPU/RSS/VSZ exhaustion and service unavailability
**How found:** Researcher reviewed XEP-0138 and RFC 6120 §13.12, noticed size-limit guidance was SHOULD not MUST and only covered uncompressed data, hypothesized decompression was unbounded, then tested black-box against Prosody, Openfire, Tigase while monitoring CPU/RSS/VSZ/disk and request throughput.
**Exploitation:** Attacker sends a 4MB zlib-compressed stanza expanding to 4GB of whitespace. Prosody allocates ~7GB RSS and is OOM-killed; Openfire hits 100% CPU, ~3GB memory, ~400MB disk writes; Tigase pins CPU at 100% for ~10 minutes. Parallel bombs (12-24) degrade availability 100x-10000x. Pre-auth variant works when compression is negotiated before authentication.
**Escalation:** Parallel/colluded xmppbombs or botnet to amplify availability degradation.
**Insight:** Compression negotiated before authentication turns a post-auth DoS into an unauthenticated one; check protocol feature-negotiation ordering (XEP-0170) and whether decompression limits apply to compressed input, not just plaintext.