# CVE-2023-26154: GO-2023-2385 - Insufficient entropy in AES-256-CBC in github.com/pubnub/go

Source: https://junglewise.ai/threats/cve-2023-26154-pubnub-insufficient-entropy-in-aes-256-cbc-encryption  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-26154 · Severity: low · CVSS 3.1 · Published 2024-01-02

PubNub is a real-time communication platform used by applications to send and receive encrypted messages. Due to an insufficient entropy flaw in the AES-256-CBC encryption implementation, the cryptographic keys generated are weakly randomized—half the key bits remain identical across all encrypted messages. An attacker with significant resources can brute-force the encryption to decrypt sensitive messages, potentially exposing confidential communications.

Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Maven](https://junglewise.ai/threats/vendors/maven), [npm](https://junglewise.ai/threats/vendors/npm), [Packagist](https://junglewise.ai/threats/vendors/packagist), [PyPI](https://junglewise.ai/threats/vendors/pypi), [Swift](https://junglewise.ai/threats/vendors/swifturl).

## Quick answers

**Is CVE-2023-26154 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-26154 being exploited in the wild.

**How severe is CVE-2023-26154?** Low severity, with a CVSS score of 3.1, published 2 January 2024.

**Which products and versions are affected?** github.com/pubnub/go (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.0.0-20231016150651-428517fef5b9; github.com/pubnub/go/v5 (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=5.0.4-0.20231016150651-428517fef5b9; github.com/pubnub/go/v6 (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=6.1.1-0.20231016150651-428517fef5b9; github.com/pubnub/go/v7 (Go) SEMVER:introduced=0,fixed=7.2.0; and 9 more.

**Is there a fix for CVE-2023-26154?** Yes. github.com/pubnub/go (Go): upgrade to 0.0.0-20231016150651-428517fef5b9 or later; github.com/pubnub/go/v5 (Go): upgrade to 5.0.4-0.20231016150651-428517fef5b9 or later; github.com/pubnub/go/v6 (Go): upgrade to 6.1.1-0.20231016150651-428517fef5b9 or later; github.com/pubnub/go/v7 (Go): upgrade to 7.2.0 or later; com.pubnub:pubnub-kotlin (Maven): upgrade to 7.7.0 or later; pubnub (npm): upgrade to 7.4.0 or later; pubnub/pubnub (Packagist): upgrade to 6.1.0 or later; pubnub (PyPI): upgrade to 7.3.0 or later; github.com/pubnub/swift (Swift): upgrade to 6.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-26154 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-26154?** Check whether you run github.com/pubnub/go (Go), github.com/pubnub/go/v5 (Go), github.com/pubnub/go/v6 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/pubnub/go (Go): upgrade to 0.0.0-20231016150651-428517fef5b9 or later

  ```sh
  go get github.com/pubnub/go@v0.0.0-20231016150651-428517fef5b9
  ```

- github.com/pubnub/go/v5 (Go): upgrade to 5.0.4-0.20231016150651-428517fef5b9 or later

  ```sh
  go get github.com/pubnub/go/v5@v5.0.4-0.20231016150651-428517fef5b9
  ```

- github.com/pubnub/go/v6 (Go): upgrade to 6.1.1-0.20231016150651-428517fef5b9 or later

  ```sh
  go get github.com/pubnub/go/v6@v6.1.1-0.20231016150651-428517fef5b9
  ```

- github.com/pubnub/go/v7 (Go): upgrade to 7.2.0 or later

  ```sh
  go get github.com/pubnub/go/v7@v7.2.0
  ```

- com.pubnub:pubnub-kotlin (Maven): upgrade to 7.7.0 or later

  ```sh
  # set com.pubnub:pubnub-kotlin to 7.7.0 in your pom.xml or build.gradle
  ```

- pubnub (npm): upgrade to 7.4.0 or later

  ```sh
  npm install pubnub@7.4.0
  ```

- pubnub/pubnub (Packagist): upgrade to 6.1.0 or later

  ```sh
  composer require pubnub/pubnub:^6.1.0
  ```

- pubnub (PyPI): upgrade to 7.3.0 or later

  ```sh
  pip install "pubnub>=7.3.0"
  ```

- github.com/pubnub/swift (Swift): upgrade to 6.2.0 or later

## Technical details

The vulnerability is a cryptographic weakness (CWE-331) in PubNub's AES-256-CBC implementation across multiple SDK versions. The root cause lies in the getKey function, which uses inefficient hex encoding and trimming that results in half the key bits being predictable and constant across encryptions. An attacker can exploit this by performing resource-intensive brute-force attacks to recover encryption keys and decrypt messages. No authentication or user interaction is required; the attack is network-accessible. The vulnerability affects all versions before specific patch versions (e.g., npm/JavaScript 7.4.0, Go v7 7.2.0, Java Kotlin 7.7.0, C# .NET 6.19.0, Swift 6.2.0, and others). Patches have been released as of October–December 2023.

## Affected products

- PubNub pubnub all versions before 7.4.0
- PubNub pubnub-kotlin all versions before 7.7.0
- PubNub github.com/pubnub/go/v7 all versions before 7.2.0
- PubNub github.com/pubnub/go all versions before 2023-10-16
- PubNub pubnub/swift all versions before 6.2.0
- PubNub Pubnub (.NET) all versions before 6.19.0
- PubNub pubnub/c-core all versions before 4.5.0
- PubNub pubnub/javascript all versions before 7.4.0
- PubNub com.pubnub:pubnub (Java) all versions up to 4.6.5

## Identifiers

- CVE-2023-26154
- GHSA-5844-q3fc-56rh
- GO-2023-2385
- PYSEC-2026-1807

## Timeline

- 2023-12-06: disclosed: Public advisory published
- 2023-10-16: patched: Go SDK patched with new crypto implementation
- 2023-08-13: other: Vulnerability initially disclosed to security researchers

## References

- [https://github.com/pubnub/go/commit/428517fef5b901db7275d9f5a75eda89a4c28e08](https://github.com/pubnub/go/commit/428517fef5b901db7275d9f5a75eda89a4c28e08)
- [https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119](https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119)
- [https://security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379](https://security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379)
- [https://security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381](https://security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381)
- [https://security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378](https://security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378)
- [https://security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377](https://security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377)