> ## Content Index > Fetch the complete content index at: https://www.process-one.net/llms.txt > Use this file to discover other available public pages before exploring further. # ejabberd 26.07 - URL: https://www.process-one.net/blog/ejabberd-26-07/ - Published: 2026-07-30T17:33:16.000Z - Updated: 2026-07-31T13:00:50.000Z - Description: We are publishing this security release ejabberd 26.07, which includes several security fixes, some improvements and other minor bugfixes. It is strongly encouraged that you update ejabberd as soon as possible. - Author: Jérôme Sautret - Tags: ejabberd, Release, XMPP **Contents:** - **[Changes in SQL schemas](#sql)** - **[Security fixes](#security)** - **[mod\_invites: New pages to create invites, reset password command and WebAdmin](#mod%5Finvites)** - **[mod\_conversejs: Support ConverseJS 14](#converse)** - **[Erlang/OTP 27.0 as a soft minimum](#erlang)** - **[Rebar/Rebar3: Update binaries to work with Erlang/OTP 26-29](#rebar)** - **[ChangeLog](#changelog)** - **[Acknowledgments](#ack)** - **[Improvements in ejabberd Business Edition](#ebe)** - **[fluux.io](#fluux)** - **[ejabberd 26.07 download & feedback](#download)** ## Changes in SQL schema If you upgrade ejabberd from a previous release to [26.07](https://docs.ejabberd.im/archive/26.07/?ref=process-one.net), there are no changes in SQL schemas, but there is one for ejabberd Business Edition (see [below](#sqlebe)). ## Security fixes This release contains fixes for those security issues: - It's possible to craft PLAIN auth request and authenticate as one user, but then open session for different one. - `mod_caps` persistent cache can be poisoned by using legacy version requests.This cache was only used to determine list of nodes that should trigger notifications in PubSub presence-based delivery. - SQL injection in `mod_pubsub` handling of paging requests. - Possible atom exhaustion that can be triggered by issuing REST requests to `mod_http_api`. - It was possible to make ejabberd send redirect response for OAuth requests to unvetted url. This required enabling ejabberd to act as OAuth provider (by adding request handler for `ejabberd_oauth` in http listener). As part of this fix we changed `oauth_client_id_check` default value to `db`. - using ejabberd as OAuth provider will be only allowed by clients that were previously registered with `oauth_add_client_password` or `oauth_add_client_implicit` commands. - Tokens generated by `mod_bosh`, `captcha`, `mod_auth_fast`, `mod_http_upload` and `mod_invites` used not cryptographically strong random number generators. - Files server by `mod_http_upload` didn't have XSS prevention headers. - Issues in authentication of SIP requests. - Request to web\_admin were lacking CSRF protection. - It was possible to skip captcha verification in mod\_register\_web. - `mod_conversejs` allowed putting unescaped value from url in page content. ## mod\_invites: New pages to create invites and WebAdmin [mod\_invites](https://docs.ejabberd.im/admin/configuration/modules/?ref=process-one.net#mod%5Finvites) now includes a startpage where regular users can use their account credentials to generate new account creation invites. This is useful for people using XMPP clients that do no support that feature. The URL of that page is the root of mod\_invites; you can find a link to that page in the bottom of WebAdmin left menu. There are also new WebAdmin pages to view the existing invites, generate new invites, expire, delete ... Go and take a look at WebAdmin > "Virtual Hosts" > one of your hosts > "Invites" There is also a new command [generate\_reset\_token](https://docs.ejabberd.im/developer/ejabberd-api/admin-api/?ref=process-one.net#generate%5Freset%5Ftoken) that returns an URI with a password reset token, just like for the invite tokens. This functionnality can also be found in the WebAdmin. ## mod\_conversejs: Support ConverseJS 14 [ConverseJS](https://conversejs.org/?ref=process-one.net) published version [14.0.0](https://github.com/conversejs/converse.js/releases/tag/v14.0.0?ref=process-one.net) recently, and it requires some changes in the web server. In this sense, [mod\_conversejs](https://docs.ejabberd.im/admin/configuration/modules/?ref=process-one.net#mod%5Fconversejs) is updated to support ConverseJS 14, and also got other minor cosmetic improvements. ## Erlang/OTP 27.0 as a soft minimum Are you compiling ejabberd with [Erlang/OTP](https://www.erlang.org/?ref=process-one.net) 25 or 26? Then please try to update to Erlang/OTP 27, 28, or 29\. For example, the ejabberd installers are compiled with Erlang/OTP 28.5.0.4. ejabberd supports compilation with Erlang/OTP 25 and 26, and those versions are still tested in [runtime.yml](https://github.com/processone/ejabberd/blob/master/.github/workflows/runtime.yml?ref=process-one.net) and [weekly.yml](https://github.com/processone/ejabberd/blob/master/.github/workflows/weekly.yml?ref=process-one.net), but those Erlang/OTP versions are not actively maintained anymore by Erlang/OTP. Following the erlang security recommendation to [Use Actively Maintained Versions of Erlang/OTP](https://www.erlang.org/doc/system/secure%5Fcoding.html?ref=process-one.net#rule-dep-003), from now ejabberd *softly* rejects compilation with Erlang/OTP lower than 27. What does *softly* mean? If you really want to compile ejabberd with Erlang/OTP lower than 27 at your own risk, you can bypass that soft requirement by defining this option (Erlang/OTP 25.0 included [Erlang Run-Time System 13.0](https://www.erlang.org/docs/25/apps/erts/notes.html?ref=process-one.net#erts-13.0), and that is the number to provide in that option): ```sh ./configure --with-min-erlang=13.0 ``` ## Rebar/Rebar3: Update binaries to work with Erlang/OTP 26-29 ejabberd source code includes [Rebar](https://github.com/rebar/rebar?ref=process-one.net) and [Rebar3](https://rebar3.org/?ref=process-one.net) binaries, in case you don't have installed in your system. But those programs only support four Erlang releases (26 up to 29). If you want to compile ejabberd with Erlang 25, then you need to grab a compatible Rebar3 (or Rebar) binary: either install one from your operating system, or you can download the old binaries included with ejabberd 26.04 (those still supported Erlang 25): ``` https://github.com/processone/ejabberd/raw/26.04/rebar https://github.com/processone/ejabberd/raw/26.04/rebar3 ``` ## ChangeLog #### Security fixes This release contains fixes for those issues: - It's possible to craft PLAIN auth request and authenticate as one user, but then open session for different one. - mod\_caps persistent cache can be poisoned by using legacy version requests. This cache was only used to determine list of nodes that should trigger notifications in PubSub presence-based delivery. - SQL injection in mod\_pubsub handling of paging requests. - Possible atom exhaustion that can be triggered by issuing REST requests to mod\_http\_api - It was possible to make ejabberd send redirect response for OAuth requests to unvetted url. This required enabling ejabberd to act as OAuth provider (by adding request handler for ejabberd\_oauth in http listener). As part of this fix we changed `oauth_client_id_check` default value to `db` - using ejabberd as OAuth provider will be only allowed by clients that were previously registered with `oauth_add_client_password` or `oauth_add_client_implicit` commands. - Tokens generated by mod\_bosh, captcha, mod\_auth\_fast, mod\_http\_upload and mod\_invites used not cryptographically strong random number generators. - Files server by mod\_http\_upload didn't have XSS prevention headers. - Issues in authentication of SIP requests. - Request to web\_admin were lacking CSRF protection. - It was possible to skip captcha verification in mod\_register\_web. - mod\_conversejs allowed putting unescaped value from url in page content. #### Core - Fixes `delete_old_messages_batch` command when used on pgsql - Adds `export_db_ext` which allows exporting db content to json files - Use constant time functions when doing password checks - Optimize `room_unused_*` commands when room hibernation is configured - We no longer add flag requesting client certificate for tls connections where certificate authentication is not enabled #### Modules - `mod_auth_fast`: Fixes exception for session that didn't set user agent - `mod_invites`: Add page for creating invites. - `mod_invites`: Fix generation of CSRF tokens. - `mod_invites`: Update to changes in latest XEP-0401 - `mod_http_upload`: Attach custom headers from config when serving files. ### Full Changelog [https://github.com/processone/ejabberd/compare/26.04...26.07](https://github.com/processone/ejabberd/compare/26.04...26.07?ref=process-one.net) ## Acknowledgments We would like to thank for the security reports provided by: - [arthurscchan](https://github.com/arthurscchan?ref=process-one.net) - [EkiXu](https://github.com/EkiXu?ref=process-one.net) - [kah-ja](https://github.com/kah-ja?ref=process-one.net) - [LautaroPetaccio](https://github.com/LautaroPetaccio?ref=process-one.net) - Marius Schwarz - [tinyb0y](https://github.com/tinyb0y?ref=process-one.net) - [X1AOxiang](https://github.com/X1AOxiang?ref=process-one.net) the contributions to the source code by: - [Stefan Strigler](https://github.com/sstrigler?ref=process-one.net) for the new features, improvements and fixes in `mod_invites` - [Christian Dröge](https://github.com/cdroege?ref=process-one.net) - [Holger Weiß](https://github.com/weiss?ref=process-one.net) - [Jonathan Davies](https://github.com/jpds?ref=process-one.net) - [Kirill A. Korinsky](https://github.com/catap?ref=process-one.net) and the translation by: - [Mr. EddX](https://github.com/MrEddX?ref=process-one.net) for updating the Bulgarian translation - [Arif Budiman](https://github.com/arifpedia?ref=process-one.net) for updating the Indonesian translation - [TamilNeram](https://github.com/TamilNeram?ref=process-one.net) for updating the Tamil translation And also to all the people contributing in the ejabberd chatroom, issue tracker... ## Improvements in ejabberd Business Edition Customers of the [ejabberd Business Edition](https://www.process-one.net/compare/), in addition to all those bugfixes, also get the following changes: ### Changes in SQL schema This release modifies the `push_customizations` table in the SQL database schemas to support the new push notifications mute option (see [below](#push)). This task is performed automatically by ejabberd by default. However, if your configuration file has disabled [update\_sql\_schema](https://docs.ejabberd.im/admin/configuration/toplevel/?ref=process-one.net#update%5Fsql%5Fschema) toplevel option, you must perform the SQL schema update manually yourself. Those instructions are valid for MySQL and PostgreSQL, both default and new schemas: #### MySQL ```sql ALTER TABLE push_customizations MODIFY COLUMN mute smallint; ``` #### PostgreSQL ```sql ALTER TABLE push_customizations ALTER COLUMN mute TYPE smallint USING mute::int; ``` ### Push notifications - Add a push customization option to allow mentioned users (as described in [XEP-0513](https://xmpp.org/extensions/xep-0513.html?ref=process-one.net)) to be notified even in muted conversation. - Make proxy connections in applepushv3 always use http connect - Report push gate tokens in the results of the `user_push_state` command - Implement push errors reporting in the results of the `user_push_state` command. - Make `mod_webpush` reject tokens that don't have correct format. - Fix `mod_webpush` key parser. - Add ability to retrieve user nodes from push\_gate. - Handle wildcard certificates now used by Google FCM service. ### Commands Add a new `local_health_status` command to return information about local node state. ### Client certificate authentication - Add option `require_xmpp_addr` that forces client certs to have `XmppAddr`. - New `recognize_email_addr` option for `mod_crl`/`mod_ocsp` to add `emailAddress` from cert subject to be used beside `xmppAddr` for matching against provided user id. ### p1db backend - Make `mam_p1db` serialization properly serialize MUC archives. - Fix JID encoding in `roster_p1db` serialization. - Fix decoding of `fast_tokens` in p1db backend ### Clustering Make `join_cluster` robust to race conditions on `leave_cluster`. ### Docker sqlite backend has been fixed in Docker image. ## fluux.io All [fluux.io](http://fluux.io/?ref=process-one.net) instances have been updated before the release of the 26.07 with the latest security fixes. ## ejabberd 26.07 download & feedback As usual, the release is tagged in the Git source code repository on [GitHub](https://github.com/processone/ejabberd?ref=process-one.net). The source package and installers are available in [ejabberd Downloads](https://www.process-one.net/download/) page. To check the `*.asc` signature files, see [How to verify ProcessOne downloads integrity](https://www.process-one.net/blog/verifying-process-one-downloads-integrity/). For convenience, there are alternative download locations like the [ejabberd DEB/RPM Packages Repository](https://repo.process-one.net/?ref=process-one.net) and the [GitHub Release / Tags](https://github.com/processone/ejabberd/tags?ref=process-one.net). The `ecs` container image is available in [docker.io/ejabberd/ecs](https://hub.docker.com/r/ejabberd/ecs/?ref=process-one.net) and [ghcr.io/processone/ecs](https://github.com/processone/docker-ejabberd/pkgs/container/ecs?ref=process-one.net). The alternative `ejabberd` container image is available in [ghcr.io/processone/ejabberd](https://github.com/processone/ejabberd/pkgs/container/ejabberd?ref=process-one.net). If you consider that you've found a bug, please search or fill a bug report on [GitHub Issues](https://github.com/processone/ejabberd/issues?ref=process-one.net).