Smack 4 includes various bug fixes including security related ones . Note that Smack 4 is a new major release with some API changes.
Available a patch for Smack 4 support @ https://jira.spring.io/browse/INT-3383
We can't update to a major release in a minor release. Postponing to 2.3.
Since we are starting a 2.3 release, this issue is being reevaluated on whether it fits in the scope of things.
Upgraded to Smack 4.1.5