Apache Vysper is an XMPP (eXtensible Messaging and Presence Protocol) server, also known as Jabber, designed to run stand-alone or embedded in another application and work with any compliant XMPP client.
Apache MINA Vysper is an XMPP server that suffers from a remote, unauthenticated denial-of-service vulnerability caused by an unbounded XML buffer in its nbxml parser. The XMLTokenizer accumulates incoming bytes into an auto-expanding buffer with no maximum token, stanza, or request size, resetting it only when a token's terminating delimiter is seen. A remote attacker can stream a single very large XML token and grow the server heap until the JVM throws OutOfMemoryError.
The vector is reachable over TCP XMPP (default port 5222), by sending a stream header followed by an endless run of character data with no closing delimiter, and over BOSH / XMPP-over-HTTP (default port 8080), where the request decoder reads the entire HTTP request body into memory before parsing, so a single large HTTP POST is sufficient. Parsing runs on the first bytes received, before authentication, so no credentials are required, and because a single JVM serves all sessions the resulting OutOfMemoryError takes down the entire server for every connected user.