USN-9067-1: Charybdis vulnerability
Published Nov 12, 2026
·Updated
It was discovered that Charybdis incorrectly validated AUTHENTICATE parameters during SASL authentication. A remote attacker could possibly use this issue to spoof certificate fingerprints and log in as another user.
Affected Software
3 affected componentsFixes available
All of the following
ubuntu/charybdis<3.5.0-1ubuntu0.1~esm1
3.5.0-1ubuntu0.1~esm1
Ubuntu Ubuntu=16.04
ubuntu/charybdis<3.5.0-1ubuntu0.1~esm1
3.5.0-1ubuntu0.1~esm1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/charybdisto a version that resolves this vulnerability.Fixed in 3.5.0-1ubuntu0.1~esm1
Event History
Nov 12, 2026
Advisory Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
DescriptionAffected Software
Advisory Published
via OSV·08:49 PM
Data Sourced
via OSV·08:49 PM
DescriptionAffected Software
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The issue is reachable remotely during SASL authentication. The attacker would need to abuse incorrectly validated AUTHENTICATE parameters to spoof certificate fingerprints and authenticate as another user.
2
What is the potential impact if exploitation succeeds?
A successful attacker could log in as another user by spoofing that user's certificate fingerprint.