UnratedFix available
pidgin — security advisory
protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.
- Products
- pidgin
- Affected versions
- Not specified
- Fixed versions
- 2.6.1-1
- CVEs
- CVE-2009-3026
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 23:00 UTC · Revision 1
Source evidence
protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.
osv:DEBIAN-CVE-2009-3026
pidgin
Fixed versions: 2.6.1-1
pidgin
Fixed versions: 2.6.1-1
pidgin
Fixed versions: 2.6.1-1
Complete source record
{
"id": "23701a939899fab6ef70911dc2182241ca51acb03c58a70663314ac583e6d3e8",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2009-3026",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2009-3026",
"summary": "protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the \"require TLS/SSL\" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.",
"evidence": "osv:DEBIAN-CVE-2009-3026",
"products": [
{
"name": {
"value": "pidgin",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.1-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "pidgin",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.1-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "pidgin",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.1-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2009-3026",
"aliases": [
"DEBIAN-CVE-2009-3026"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.1-1"
}
]
}
],
"package": {
"name": "pidgin",
"purl": "pkg:deb/debian/pidgin?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3026.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.1-1"
}
]
}
],
"package": {
"name": "pidgin",
"purl": "pkg:deb/debian/pidgin?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3026.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.1-1"
}
]
}
],
"package": {
"name": "pidgin",
"purl": "pkg:deb/debian/pidgin?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3026.json"
},
"ecosystem_specific": {
"urgency": "low"
}
}
],
"modified": "2026-10-23T17:47:31.984680960Z",
"provider": "osv",
"upstream": [
"CVE-2009-3026"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2009-3026"
]
},
"related_cves": [
{
"value": "CVE-2009-3026",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 417475,
"published_at": "2009-08-31T20:30:01.14+00:00"
}