Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2023-26154: Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the pa

46
This week
MEDIUM 5.9REMOTEUPGRADEUPGRADEUPGRADE

CVE-2023-26154 is a medium-severity flaw (CVSS 5.9) affecting c-core, kotlin, pubnub. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of t

Why this priority

  • Public exploit reference
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score5.9 (Medium)
Attack vectorNetwork (remote)
Attack complexityHigh
Privileges neededNone
User interactionNone
EPSS exploit chance1.0% (top 38%)
CISA exploited listNo
WeaknessCWE-331
Published2023-12-06
Last modified2026-06-17
Publisher (CNA): Snyk · Vendor: pubnub

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

pubnub c-core UPGRADE
Affected: < 4.5.0
Fixed in: 4.5.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy c-core || rpm -q c-core || c-core --version
2. UPGRADE to 4.5.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade c-core
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade c-core
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
pubnub kotlin UPGRADE
Affected: < 7.7.0
Fixed in: 7.7.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy kotlin || rpm -q kotlin || kotlin --version
2. UPGRADE to 7.7.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade kotlin
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade kotlin
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
pubnub pubnub UPGRADE
Affected: < 0.4.0 · >= 3.6.4 and < 4.3.0 · >= 4.3.1 and < 5.2.0 · >= 6.0.0 and < 6.1.0 · >= 6.2.0 and < 6.19.0 · >= 7.0.0 and < 7.3.0 · >= 7.3.1 and < 7.4.0
Fixed in: 0.4.0, 4.3.0, 5.2.0, 6.1.0, 6.19.0, 7.3.0, 7.4.0
Safe to downgrade to: a release before 3.6.4
1. Check installed version
apt-cache policy pubnub || rpm -q pubnub || pubnub --version
2. UPGRADE to 0.4.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade pubnub
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade pubnub
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 3.6.4 (Debian / Ubuntu)
apt-cache madison pubnub sudo apt install pubnub=<VERSION_BEFORE_3.6.4> sudo apt-mark hold pubnub
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list pubnub sudo dnf downgrade pubnub-<VERSION_BEFORE_3.6.4> sudo dnf versionlock add pubnub
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
pubnub pubnub UPGRADE
Affected: < 7.2.0
Fixed in: 7.2.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy pubnub || rpm -q pubnub || pubnub --version
2. UPGRADE to 7.2.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade pubnub
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade pubnub
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
pubnub swift UPGRADE
Affected: < 6.2.0
Fixed in: 6.2.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy swift || rpm -q swift || swift --version
2. UPGRADE to 6.2.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade swift
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade swift
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2023-26154?

c-core: upgrade to 4.5.0; kotlin: upgrade to 7.7.0; pubnub: upgrade to 0.4.0, 4.3.0, 5.2.0, 6.1.0, 6.19.0, 7.3.0, 7.4.0. Exact commands for each OS are on this page.

Is CVE-2023-26154 being exploited?

CVE-2023-26154 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2023-26154 affect?

CVE-2023-26154 affects c-core, kotlin, pubnub. Severity is medium (CVSS 5.9). Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 befo

How urgent is CVE-2023-26154?

Priority 46/100. Public exploit reference; Remotely exploitable, no login, no user action

Software pages

GitHub vulnerabilities · Kotlin vulnerabilities · Swift vulnerabilities

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.