Unrated severityNVD Advisory· Published Aug 31, 2009· Updated Jun 16, 2026
CVE-2009-3026
CVE-2009-3026
Description
protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2cpe:2.3:a:pidgin:pidgin:2.6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:pidgin:pidgin:2.6.0:*:*:*:*:*:*:*
- (no CPE)range: <=2.6.0
Patches
Vulnerability mechanics
References
9- developer.pidgin.im/viewmtn/revision/diff/312e056d702d29379ea61aea9d27765f127bc888/with/55897c4ce0787edc1e7721b7f4a9b5cbc8357279nvdPatch
- bugs.debian.org/cgi-bin/bugreport.cginvd
- developer.pidgin.im/ticket/8131nvd
- secunia.com/advisories/37071nvd
- www.openwall.com/lists/oss-security/2009/08/24/2nvd
- www.securityfocus.com/bid/36368nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/53000nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11070nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5757nvd
News mentions
0No linked articles in our index yet.