Update Smack to the latest version. 4.1.9 has a critical security fix. https://community.igniterealtime.org/blogs/ignite/2016/11/22/smack-security-advisory-2016-11-22
Merged https://github.com/igniterealtime/Spark/pull/263