Most recent entries from all

EUVD-2026-325002

fkie_cve-2026-48829

In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.

GHSA-5px8-3qcf-qpm5

In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.

OESA-2026-3372 — libgsasl security update

Affected: openEuler:24.03-LTS-SP1: libgsasl

The library includes support for the SASL framework and at least partial support for the CRAM-MD5, EXTERNAL, GSSAPI, ANONYMOUS, PLAIN, SECURID, DIGEST-MD5, LOGIN, and NTLM mechanisms. Security Fix(es):

In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.(CVE-2026-48829)

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.(CVE-2026-56968)

openSUSE-SU-2026:10891-1 — gsasl-2.2.3-1.1 on GA media

gsasl-2.2.3-1.1 on GA media

SUSE-SU-2026:22313-1 — Security update for gsasl

Security update for gsasl

UBUNTU-CVE-2026-48829

Affected: Ubuntu:Pro:14.04:LTS: gsasl, Ubuntu:Pro:16.04:LTS: gsasl, Ubuntu:Pro:18.04:LTS: gsasl, Ubuntu:Pro:20.04:LTS: gsasl, Ubuntu:Pro:22.04:LTS: gsasl, Ubuntu:24.04:LTS: gsasl, Ubuntu:25.10: gsasl, Ubuntu:26.04:LTS: gsasl

In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.