CVE-2022-2469

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client

3.8 LowFix available

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: Low

Exploit likelihood

1.57%Up 0.7 points since Jul 20, 2022

What each source reports

CVE List Score used 3.8

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client

Record: CVE-2022-2469
CVSS 3.1: 3.8 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

EUVDEUVD-2022-34729 3.8

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client

Record: EUVD-2022-34729
CVSS 3.1: 3.8 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r9xr-xfwx-6crw 8.1

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client

Record: GHSA-r9xr-xfwx-6crw
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

NVD 3.8

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client

Record: CVE-2022-2469
CVSS 3.1: 3.8 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSV 3.8

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client

Record: CVE-2022-2469
CVSS 3.1: 3.8 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-2469 8.1

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client

Record: DEBIAN-CVE-2022-2469
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-03

Show 14 moreShow less

OSVOESA-2024-1351 8.1

libgsasl security update

The library includes support for the SASL framework and at least partial support for the CRAM-MD5, EXTERNAL, GSSAPI, ANONYMOUS, PLAIN, SECURID, DIGEST-MD5, LOGIN, and NTLM mechanisms.

Security Fix(es):

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client(CVE-2022-2469)

Record: OESA-2024-1351
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVOESA-2024-1441 8.1

libgsasl security update

The library includes support for the SASL framework and at least partial support for the CRAM-MD5, EXTERNAL, GSSAPI, ANONYMOUS, PLAIN, SECURID, DIGEST-MD5, LOGIN, and NTLM mechanisms.

Security Fix(es):

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client(CVE-2022-2469)

Record: OESA-2024-1441
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVOESA-2024-1442 8.1

libgsasl security update

The library includes support for the SASL framework and at least partial support for the CRAM-MD5, EXTERNAL, GSSAPI, ANONYMOUS, PLAIN, SECURID, DIGEST-MD5, LOGIN, and NTLM mechanisms.

Security Fix(es):

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client(CVE-2022-2469)

Record: OESA-2024-1442
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVOESA-2024-1443 8.1

libgsasl security update

The library includes support for the SASL framework and at least partial support for the CRAM-MD5, EXTERNAL, GSSAPI, ANONYMOUS, PLAIN, SECURID, DIGEST-MD5, LOGIN, and NTLM mechanisms.

Security Fix(es):

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client(CVE-2022-2469)

Record: OESA-2024-1443
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVOESA-2024-1444 8.1

libgsasl security update

The library includes support for the SASL framework and at least partial support for the CRAM-MD5, EXTERNAL, GSSAPI, ANONYMOUS, PLAIN, SECURID, DIGEST-MD5, LOGIN, and NTLM mechanisms.

Security Fix(es):

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client(CVE-2022-2469)

Record: OESA-2024-1444
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVOESA-2024-1445 8.1

libgsasl security update

The library includes support for the SASL framework and at least partial support for the CRAM-MD5, EXTERNAL, GSSAPI, ANONYMOUS, PLAIN, SECURID, DIGEST-MD5, LOGIN, and NTLM mechanisms.

Security Fix(es):

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client(CVE-2022-2469)

Record: OESA-2024-1445
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-2469 3.8

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client

Record: UBUNTU-CVE-2022-2469
CVSS 3.1: 3.8 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2022-0298 No score

Updated libgsasl packages fix security vulnerability

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client. (CVE-2022-2469)

Record: MGASA-2022-0298
Updated: 2026-11-02

OSVopenSUSE-SU-2024:12325-1 No score

libgsasl-devel-1.10.0-3.1 on GA media

These are all security issues fixed in the libgsasl-devel-1.10.0-3.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:12325-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13666-1 No score

gsasl-2.2.1-1.1 on GA media

These are all security issues fixed in the gsasl-2.2.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13666-1
Updated: 2026-11-02

OSVSUSE-SU-2022:3561-1 No score

Security update for libgsasl

This update for libgsasl fixes the following issues:

CVE-2022-2469: Fixed OOB read in GSSAPI server (bsc#1201715).

Record: SUSE-SU-2022:3561-1
Updated: 2026-11-02

OSVSUSE-SU-2022:3562-1 No score

Security update for libgsasl

This update for libgsasl fixes the following issues:

CVE-2022-2469: Fixed OOB read in GSSAPI server (bsc#1201715).

Record: SUSE-SU-2022:3562-1
Updated: 2026-11-02

OSVSUSE-SU-2022:3563-1 No score

Security update for libgsasl

This update for libgsasl fixes the following issues:

CVE-2022-2469: Fixed OOB read in GSSAPI server (bsc#1201715).

Record: SUSE-SU-2022:3563-1
Updated: 2026-11-02

OSVUSN-6169-1 No score

gsasl vulnerability

It was discovered that GNU SASL's GSSAPI server could make an out-of-bounds reads if given specially crafted GSS-API authentication data. A remote attacker could possibly use this issue to cause a denial of service or to expose sensitive information.

Record: USN-6169-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`gsasl` Debian:12	before 2.0.1-1	2.0.1-1
`gsasl` Debian:13	before 2.0.1-1	2.0.1-1
`gsasl` Debian:14	before 2.0.1-1	2.0.1-1
`gsasl` Debian:10	before 1.8.0-8+deb10u1, plus listed versions 1.8.0-8	1.8.0-8+deb10u1
`gsasl` Debian:11	before 1.10.0-4+deb11u1, plus listed versions 1.10.0-4	1.10.0-4+deb11u1
`libgsasl` Mageia:8	before 1.8.1-2.1.mga8	1.8.1-2.1.mga8
`libgsasl` openEuler:22.03-LTS-SP3	before 1.8.1-1.oe2203sp3	1.8.1-1.oe2203sp3
`libgsasl` openEuler:20.03-LTS-SP1	before 1.8.1-2.oe1	1.8.1-2.oe1
`libgsasl` openEuler:20.03-LTS-SP4	before 1.8.1-2.oe2003sp4	1.8.1-2.oe2003sp4
`libgsasl` openEuler:22.03-LTS	before 1.8.1-2.oe2203	1.8.1-2.oe2203

Show 13 moreShow less

Affected packages
Package	Affected	Fixed
`libgsasl` openEuler:22.03-LTS-SP1	before 1.8.1-2.oe2203sp1	1.8.1-2.oe2203sp1
`libgsasl` openEuler:22.03-LTS-SP2	before 1.8.1-2.oe2203sp2	1.8.1-2.oe2203sp2
`libgsasl` SUSE:Manager Proxy Module 4.2	before 1.8.0-150300.3.3.1	1.8.0-150300.3.3.1
`libgsasl` SUSE:Manager Server Module 4.2	before 1.8.0-150300.3.3.1	1.8.0-150300.3.3.1
`libgsasl` SUSE:Manager Proxy Module 4.1	before 1.8.0-150200.3.3.1	1.8.0-150200.3.3.1
`libgsasl` SUSE:Manager Server Module 4.1	before 1.8.0-150200.3.3.1	1.8.0-150200.3.3.1
`libgsasl` SUSE:Manager Proxy Module 4.3	before 1.8.0-150400.3.3.1	1.8.0-150400.3.3.1
`libgsasl` SUSE:Manager Server Module 4.3	before 1.8.0-150400.3.3.1	1.8.0-150400.3.3.1
`gsasl` Ubuntu:Pro:14.04:LTS	before 1.8.0-2ubuntu2+esm1, plus listed versions 1.8.0-2ubuntu11.8.0-2ubuntu2	1.8.0-2ubuntu2+esm1
`gsasl` Ubuntu:Pro:16.04:LTS	before 1.8.0-8ubuntu2+esm1, plus listed versions 1.8.0-8ubuntu11.8.0-8ubuntu2	1.8.0-8ubuntu2+esm1
`gsasl` Ubuntu:Pro:18.04:LTS	before 1.8.0-8ubuntu3+esm2, plus listed versions 1.8.0-8ubuntu3	1.8.0-8ubuntu3+esm2
`gsasl` Ubuntu:Pro:20.04:LTS	before 1.8.1-1ubuntu0.1~esm1, plus listed versions 1.8.0-8ubuntu31.8.1-1	1.8.1-1ubuntu0.1~esm1
`gsasl` Ubuntu:Pro:22.04:LTS	before 1.10.0-5ubuntu0.1~esm1, plus listed versions 1.10.0-41.10.0-5	1.10.0-5ubuntu0.1~esm1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-2469 is a low vulnerability (CVSS 3.8) in Gnu Sasl, published July 19, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.57%, the 75th percentile. Fixed in gsasl 2.0.1-1.

References

Show 17 moreShow less