CVE-2009-3026

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-08-31 · updated 2026-06-16
Weakness: CWE-310

Description

protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.

Affected products

Pidgin: 2.6.0

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542891
http://developer.pidgin.im/ticket/8131
http://developer.pidgin.im/viewmtn/revision/diff/312e056d702d29379ea61aea9d27765f127bc888/with/55897c4ce0787edc1e7721b7f4a9b5cbc8357279
http://secunia.com/advisories/37071
http://www.openwall.com/lists/oss-security/2009/08/24/2
http://www.securityfocus.com/bid/36368
https://exchange.xforce.ibmcloud.com/vulnerabilities/53000
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11070
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5757
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542891
http://developer.pidgin.im/ticket/8131
http://developer.pidgin.im/viewmtn/revision/diff/312e056d702d29379ea61aea9d27765f127bc888/with/55897c4ce0787edc1e7721b7f4a9b5cbc8357279

Get alerted when CVE-2009-3026 or the next vulnerability affects your stack