> ## Content Index
> Fetch the complete content index at: https://www.process-one.net/llms.txt
> Use this file to discover other available public pages before exploring further.

# ejabberd 26.04
- URL: https://www.process-one.net/blog/ejabberd-26-04/
- Published: 2026-04-20T14:42:42.000Z
- Updated: 2026-04-20T14:42:42.000Z
- Description: We are publishing this security release ejabberd 26.04, which includes options to limit XML parser, and other minor bugfixes. It is strongly encouraged that you update ejabberd as soon as possible.
- Author: Jérôme Sautret
- Tags: ejabberd, Release, XMPP

**Contents:**

- **[New limits options for XML parser](#parser)**
- **[ChangeLog](#changelog)**
- **[Acknowledgments](#ack)**
- **[ejabberd 26.04 download & feedback](#download)**

## New limits options for XML parser

This release adds new options that limit max memory used by XML parser used to process XMPP payloads, to prevent potential Denial of Service attack. The default values for pre-auth provide sufficient protection for ejabberd against non-authenticated users on c2s and s2s, so there is no need to change your configuration.

The option `max_stanza_elements` sets a limit on the maximum number of XML elements that an individual stanza can contain. By default, this option is set to `infinity`.

The pair of options `pre_auth_max_stanza_elements` and `pre_auth_max_stanza_size` define separate limits for sessions that haven't authenticated yet. The session will switch to the limits defined by the options `max_stanza_elements` and `max_stanza_size` after the client has successfully authenticated. The default values for these options are: 32 for `pre_auth_max_stanza_elements` and 8192 for `pre_auth_max_stanza_size`.

All those options are recognized inside listener sections, and can be applied to `ejabberd_c2s` and `ejabberd_s2s_in` listeners.

## ChangeLog

#### Core

- Add new listener options to limit xml parser accepted input
- Improve `leave_cluster` command to work even in own node
- New predefined keyword `DATABASE_PATH` that points to the Mnesia spool dir
- Support HOST keyword in `sql_database` toplevel option, set nice default value
- Provide more details in log messages when using SQLite
- Update documentation of jwt\_key to match the Docs site
- ejabberd\_config: New default\_ram\_db/3 clause that checks module support
- ejabberd\_sm: Remove session\_counter, used for get\_vh\_session\_number now removed

#### Modules

- `mod_http_fileserver`: Use integer in `ejabberd_hooks:add` as expected by "make hooks"
- `mod_invites`: Add `--enable-bootstrap=no` to configure options to bypass download ([#4558](https://github.com/processone/ejabberd/pull/4558?ref=process-one.net))
- `mod_invites`: don't crash in `get_invite_by_invitee_t` for sql backend ([#4566](https://github.com/processone/ejabberd/pull/4566?ref=process-one.net))
- `mod_invites`: quick howto for creating integrity check checksums
- `mod_invites`: remove dependency on jquery
- `mod_mqtt`: Define RAM callbacks as optional
- `mod_mqtt`: Use `default_ram_db` only if it really supports RAM storage
- `mod_roster`: Fix bug introduced in 26.03 in commit d5c1440 ([#4564](https://github.com/processone/ejabberd/issues/4564?ref=process-one.net))
- `mod_roster_sql`: Cast `approved` integer as boolean when exporting Mnesia to SQL
- `mod_shared_roster_sql`: Fix typo introduced 10 years ago in commit 0ea0ba30

#### Container and Installers

- Bump Erlang/OTP 28.4.2
- make-binaries: Bump OpenSSL to 3.5.6

### Full Changelog

[https://github.com/processone/ejabberd/compare/26.03...26.04](https://github.com/processone/ejabberd/compare/26.02...26.03?ref=process-one.net)

## Acknowledgments

We would like to thank the contributions to the source code, documentation, and translation provided for this release by:

- [Stefan Strigler](https://github.com/sstrigler?ref=process-one.net) for the improvements in `mod_invites`

And also to all the people contributing in the ejabberd chatroom, issue tracker...

##  ejabberd 26.04 download & feedback

As usual, the release is tagged in the Git source code repository on [GitHub](https://github.com/processone/ejabberd?ref=process-one.net).

The source package and installers are available in [ejabberd Downloads](https://www.process-one.net/download/) page. To check the `*.asc` signature files, see [How to verify ProcessOne downloads integrity](https://www.process-one.net/blog/verifying-process-one-downloads-integrity/).

For convenience, there are alternative download locations like the [ejabberd DEB/RPM Packages Repository](https://repo.process-one.net/?ref=process-one.net) and the [GitHub Release / Tags](https://github.com/processone/ejabberd/tags?ref=process-one.net).

The `ecs` container image is available in [docker.io/ejabberd/ecs](https://hub.docker.com/r/ejabberd/ecs/?ref=process-one.net) and [ghcr.io/processone/ecs](https://github.com/processone/docker-ejabberd/pkgs/container/ecs?ref=process-one.net). The alternative `ejabberd` container image is available in [ghcr.io/processone/ejabberd](https://github.com/processone/ejabberd/pkgs/container/ejabberd?ref=process-one.net).

If you consider that you've found a bug, please search or fill a bug report on [GitHub Issues](https://github.com/processone/ejabberd/issues?ref=process-one.net).