Versions of the package pubnub before 7.4.0; all versions of the package…
Priority LOW 28CWE-331Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file. **Note:** In order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption.
Why it matters now
EPSS 0.00963 61st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed pubnub: 7.4.0, 7.3.0, 5.3.0 +2Pubnub: 6.19.0+19 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | pubnub | before 7.4.0 | 7.4.0 | Patch available | CNA |
| — | com.pubnub:pubnub | all versions | — | No fix listed | CNA |
| — | Pubnub | before 6.19.0 | 6.19.0 | Patch available | CNA |
| — | github.com/pubnub/go | all versions | — | No fix listed | CNA |
| — | github.com/pubnub/go/v7 | before 7.2.0 | 7.2.0 | Patch available | CNA |
| — | pubnub | before 7.3.0 | 7.3.0 | Patch available | CNA |
| — | pubnub/pubnub | before 6.1.0 | 6.1.0 | Patch available | CNA |
| — | pubnub | before 5.3.0 | 5.3.0 | Patch available | CNA |
| — | pubnub | before 0.4.0 | 0.4.0 | Patch available | CNA |
| — | pubnub/c-core | before 4.5.0 | 4.5.0 | Patch available | CNA |
| — | com.pubnub:pubnub-kotlin | before 7.7.0 | 7.7.0 | Patch available | CNA |
| — | pubnub/swift | before 6.2.0 | 6.2.0 | Patch available | CNA |
| — | PubNub | before 5.2.0 | 5.2.0 | Patch available | CNA |
| — | pubnub | before 4.3.0 | 4.3.0 | Patch available | CNA |
| — | pubnub (npm) | before 7.4.0 | 7.4.0 | Patch available | GHSA-5844-q3fc-56rh |
| — | com.pubnub:pubnub-kotlin (Maven) | before 7.7.0 | 7.7.0 | Patch available | GHSA-5844-q3fc-56rh |
| — | com.pubnub:pubnub (Maven) | up to 4.6.5 | — | No fix listed | GHSA-5844-q3fc-56rh |
| — | github.com/pubnub/go/v7 (Go) | before 7.2.0 | 7.2.0 | Patch available | GHSA-5844-q3fc-56rh |
| — | github.com/pubnub/go (Go) | before 0.0.0-20231016150651-428517fef5b9 | 0.0.0-20231016150651-428517fef5b9 | Patch available | GHSA-5844-q3fc-56rh |
| — | github.com/pubnub/go/v6 (Go) | before 6.1.1-0.20231016150651-428517fef5b9 | 6.1.1-0.20231016150651-428517fef5b9 | Patch available | GHSA-5844-q3fc-56rh |
| — | github.com/pubnub/go/v5 (Go) | before 5.0.4-0.20231016150651-428517fef5b9 | 5.0.4-0.20231016150651-428517fef5b9 | Patch available | GHSA-5844-q3fc-56rh |
| — | Pubnub (NuGet) | before 6.19.0 | 6.19.0 | Patch available | GHSA-5844-q3fc-56rh |
| — | github.com/pubnub/swift (SwiftURL) | before 6.2.0 | 6.2.0 | Patch available | GHSA-5844-q3fc-56rh |
| — | pubnub (RubyGems) | before 5.3.0 | 5.3.0 | Patch available | GHSA-5844-q3fc-56rh |
| — | pubnub (crates.io) | before 0.4.0 | 0.4.0 | Patch available | GHSA-5844-q3fc-56rh |
| — | pubnub/pubnub (Packagist) | before 6.1.0 | 6.1.0 | Patch available | GHSA-5844-q3fc-56rh |
| — | pubnub (Pub) | before 4.3.0 | 4.3.0 | Patch available | GHSA-5844-q3fc-56rh |
| — | pubnub (PyPI) | before 7.3.0 | 7.3.0 | Patch available | GHSA-5844-q3fc-56rh |
- pubnub Vendor— Affected before 7.4.0 Fixed in 7.4.0 Patch available CNA
- com.pubnub:pubnub Vendor— Affected all versions Fixed in — No fix listed CNA
- Pubnub Vendor— Affected before 6.19.0 Fixed in 6.19.0 Patch available CNA
- github.com/pubnub/go Vendor— Affected all versions Fixed in — No fix listed CNA
- github.com/pubnub/go/v7 Vendor— Affected before 7.2.0 Fixed in 7.2.0 Patch available CNA
- pubnub Vendor— Affected before 7.3.0 Fixed in 7.3.0 Patch available CNA
- pubnub/pubnub Vendor— Affected before 6.1.0 Fixed in 6.1.0 Patch available CNA
- pubnub Vendor— Affected before 5.3.0 Fixed in 5.3.0 Patch available CNA
- pubnub Vendor— Affected before 0.4.0 Fixed in 0.4.0 Patch available CNA
- pubnub/c-core Vendor— Affected before 4.5.0 Fixed in 4.5.0 Patch available CNA
- com.pubnub:pubnub-kotlin Vendor— Affected before 7.7.0 Fixed in 7.7.0 Patch available CNA
- pubnub/swift Vendor— Affected before 6.2.0 Fixed in 6.2.0 Patch available CNA
- PubNub Vendor— Affected before 5.2.0 Fixed in 5.2.0 Patch available CNA
- pubnub Vendor— Affected before 4.3.0 Fixed in 4.3.0 Patch available CNA
- pubnub (npm) Vendor— Affected before 7.4.0 Fixed in 7.4.0 Patch available GHSA-5844-q3fc-56rh
- com.pubnub:pubnub-kotlin (Maven) Vendor— Affected before 7.7.0 Fixed in 7.7.0 Patch available GHSA-5844-q3fc-56rh
- com.pubnub:pubnub (Maven) Vendor— Affected up to 4.6.5 Fixed in — No fix listed GHSA-5844-q3fc-56rh
- github.com/pubnub/go/v7 (Go) Vendor— Affected before 7.2.0 Fixed in 7.2.0 Patch available GHSA-5844-q3fc-56rh
- github.com/pubnub/go (Go) Vendor— Affected before 0.0.0-20231016150651-428517fef5b9 Fixed in 0.0.0-20231016150651-428517fef5b9 Patch available GHSA-5844-q3fc-56rh
- github.com/pubnub/go/v6 (Go) Vendor— Affected before 6.1.1-0.20231016150651-428517fef5b9 Fixed in 6.1.1-0.20231016150651-428517fef5b9 Patch available GHSA-5844-q3fc-56rh
- github.com/pubnub/go/v5 (Go) Vendor— Affected before 5.0.4-0.20231016150651-428517fef5b9 Fixed in 5.0.4-0.20231016150651-428517fef5b9 Patch available GHSA-5844-q3fc-56rh
- Pubnub (NuGet) Vendor— Affected before 6.19.0 Fixed in 6.19.0 Patch available GHSA-5844-q3fc-56rh
- github.com/pubnub/swift (SwiftURL) Vendor— Affected before 6.2.0 Fixed in 6.2.0 Patch available GHSA-5844-q3fc-56rh
- pubnub (RubyGems) Vendor— Affected before 5.3.0 Fixed in 5.3.0 Patch available GHSA-5844-q3fc-56rh
- pubnub (crates.io) Vendor— Affected before 0.4.0 Fixed in 0.4.0 Patch available GHSA-5844-q3fc-56rh
- pubnub/pubnub (Packagist) Vendor— Affected before 6.1.0 Fixed in 6.1.0 Patch available GHSA-5844-q3fc-56rh
- pubnub (Pub) Vendor— Affected before 4.3.0 Fixed in 4.3.0 Patch available GHSA-5844-q3fc-56rh
- pubnub (PyPI) Vendor— Affected before 7.3.0 Fixed in 7.3.0 Patch available GHSA-5844-q3fc-56rh
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pubnub:c-core:*:*:*:*:*:*:*:* | before 4.5.0 | Vulnerable | Pubnub |
| cpe:2.3:a:pubnub:kotlin:*:*:*:*:*:*:*:* | before 7.7.0 | Vulnerable | Pubnub |
| cpe:2.3:a:pubnub:pubnub:*:*:*:*:*:-:*:* | before 0.4.0 | Vulnerable | Pubnub |
| cpe:2.3:a:pubnub:pubnub:*:*:*:*:*:go:*:* | before 7.2.0 | Vulnerable | Pubnub |
| cpe:2.3:a:pubnub:pubnub:*:*:*:*:*:-:*:* | 3.6.4 to before 4.3.0; 4.3.1 to before 5.2.0; 6.0.0 to before 6.1.0; 6.2.0 to before 6.19.0; 7.0.0 to before 7.3.0; 7.3.1 to before 7.4.0 | Vulnerable | Pubnub |
| cpe:2.3:a:pubnub:swift:*:*:*:*:*:*:*:* | before 6.2.0 | Vulnerable | Pubnub |
- cpe:2.3:a:pubnub:c-core:*:*:*:*:*:*:*:* Versions before 4.5.0 Vulnerable ·Pubnub
- cpe:2.3:a:pubnub:kotlin:*:*:*:*:*:*:*:* Versions before 7.7.0 Vulnerable ·Pubnub
- cpe:2.3:a:pubnub:pubnub:*:*:*:*:*:-:*:* Versions before 0.4.0 Vulnerable ·Pubnub
- cpe:2.3:a:pubnub:pubnub:*:*:*:*:*:go:*:* Versions before 7.2.0 Vulnerable ·Pubnub
- cpe:2.3:a:pubnub:pubnub:*:*:*:*:*:-:*:* Versions 3.6.4 to before 4.3.0; 4.3.1 to before 5.2.0; 6.0.0 to before 6.1.0; 6.2.0 to before 6.19.0; 7.0.0 to before 7.3.0; 7.3.1 to before 7.4.0 Vulnerable ·Pubnub
- cpe:2.3:a:pubnub:swift:*:*:*:*:*:*:*:* Versions before 6.2.0 Vulnerable ·Pubnub
Remediation
- Fix · CNA pubnub Fixed in 7.4.0
- Fix · CNA Pubnub Fixed in 6.19.0
- Fix · CNA github.com/pubnub/go/v7 Fixed in 7.2.0
- Fix · CNA pubnub Fixed in 7.3.0
- Fix · CNA pubnub/pubnub Fixed in 6.1.0
- Fix · CNA pubnub Fixed in 5.3.0
- Fix · CNA pubnub Fixed in 0.4.0
- Fix · CNA pubnub/c-core Fixed in 4.5.0
- Fix · CNA com.pubnub:pubnub-kotlin Fixed in 7.7.0
- Fix · CNA pubnub/swift Fixed in 6.2.0
- Fix · CNA PubNub Fixed in 5.2.0
- Fix · CNA pubnub Fixed in 4.3.0
- Fix · GHSA-5844-q3fc-56rh pubnub (npm) Fixed in 7.4.0 Advisory →
- Fix · GHSA-5844-q3fc-56rh com.pubnub:pubnub-kotlin (Maven) Fixed in 7.7.0 Advisory →
- Fix · GHSA-5844-q3fc-56rh github.com/pubnub/go/v7 (Go) Fixed in 7.2.0 Advisory →
- Fix · GHSA-5844-q3fc-56rh github.com/pubnub/go (Go) Fixed in 0.0.0-20231016150651-428517fef5b9 Advisory →
- Fix · GHSA-5844-q3fc-56rh github.com/pubnub/go/v6 (Go) Fixed in 6.1.1-0.20231016150651-428517fef5b9 Advisory →
- Fix · GHSA-5844-q3fc-56rh github.com/pubnub/go/v5 (Go) Fixed in 5.0.4-0.20231016150651-428517fef5b9 Advisory →
- Fix · GHSA-5844-q3fc-56rh Pubnub (NuGet) Fixed in 6.19.0 Advisory →
- Fix · GHSA-5844-q3fc-56rh github.com/pubnub/swift (SwiftURL) Fixed in 6.2.0 Advisory →
- Fix · GHSA-5844-q3fc-56rh pubnub (RubyGems) Fixed in 5.3.0 Advisory →
- Fix · GHSA-5844-q3fc-56rh pubnub (crates.io) Fixed in 0.4.0 Advisory →
- Fix · GHSA-5844-q3fc-56rh pubnub/pubnub (Packagist) Fixed in 6.1.0 Advisory →
- Fix · GHSA-5844-q3fc-56rh pubnub (Pub) Fixed in 4.3.0 Advisory →
- Fix · GHSA-5844-q3fc-56rh pubnub (PyPI) Fixed in 7.3.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-26154
- 2026-10-03 Alias added: GHSA-5844-q3fc-56rh
References
Advisory 2
Other 5
- https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70
- https://github.com/pubnub/go/commit/428517fef5b901db7275d9f5a75eda89a4c28e08
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pubnub/CVE-2023-26154.yml
- https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js#L70
- https://github.com/pubnub/javascript
Sources
- CVE-2023-26154 · CVE Program
- CVE-2023-26154 · NVD
- FIRST EPSS
- GHSA-5844-q3fc-56rh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences