Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream aka an \xmppbomb\ attack.