Every CVE Search/ Get API key

CVE-2026-56968

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the...

3.7 LowFix available

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.41%Up 0.2 points since Jun 24, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.7

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

Record
CVE-2026-56968
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-839
Updated
2026-11-02
EUVDEUVD-2026-38512 3.7

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

Record
EUVD-2026-38512
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-2qgp-6c6g-cmwv 3.7

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the...

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

Record
GHSA-2qgp-6c6g-cmwv
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-839, CWE-908
Updated
2026-11-02
NVD 3.7

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

Record
CVE-2026-56968
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-839, CWE-908
Updated
2026-11-02
OSVDEBIAN-CVE-2026-56968 5.3

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

Record
DEBIAN-CVE-2026-56968
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-3372 7.5

libgsasl security update

The library includes support for the SASL framework and at least partial support for the CRAM-MD5, EXTERNAL, GSSAPI, ANONYMOUS, PLAIN, SECURID, DIGEST-MD5, LOGIN, and NTLM mechanisms.

Security Fix(es):

In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.(CVE-2026-48829)

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.(CVE-2026-56968)

Record
OESA-2026-3372
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVOESA-2026-3373 7.5

libgsasl security update

The library includes support for the SASL framework and at least partial support for the CRAM-MD5, EXTERNAL, GSSAPI, ANONYMOUS, PLAIN, SECURID, DIGEST-MD5, LOGIN, and NTLM mechanisms.

Security Fix(es):

In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.(CVE-2026-48829)

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.(CVE-2026-56968)

Record
OESA-2026-3373
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3374 7.5

libgsasl security update

The library includes support for the SASL framework and at least partial support for the CRAM-MD5, EXTERNAL, GSSAPI, ANONYMOUS, PLAIN, SECURID, DIGEST-MD5, LOGIN, and NTLM mechanisms.

Security Fix(es):

In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.(CVE-2026-48829)

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.(CVE-2026-56968)

Record
OESA-2026-3374
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3375 7.5

libgsasl security update

The library includes support for the SASL framework and at least partial support for the CRAM-MD5, EXTERNAL, GSSAPI, ANONYMOUS, PLAIN, SECURID, DIGEST-MD5, LOGIN, and NTLM mechanisms.

Security Fix(es):

In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.(CVE-2026-48829)

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.(CVE-2026-56968)

Record
OESA-2026-3375
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3443 7.5

libgsasl security update

The library includes support for the SASL framework and at least partial support for the CRAM-MD5, EXTERNAL, GSSAPI, ANONYMOUS, PLAIN, SECURID, DIGEST-MD5, LOGIN, and NTLM mechanisms.

Security Fix(es):

In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.(CVE-2026-48829)

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.(CVE-2026-56968)

Record
OESA-2026-3443
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-56968 3.7

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

Record
UBUNTU-CVE-2026-56968
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:21303-1 No score

Security update for gsasl

This update for gsasl fixes the following issue

  • CVE-2026-56968: improper sanitization of a short challenge in _gsasl_ntlm_client_step of the NTLM client can lead to memory disclosure (bsc#1268885).
Record
openSUSE-SU-2026:21303-1
Updated
2026-11-02
OSVSUSE-SU-2026:22631-1 No score

Security update for gsasl

This update for gsasl fixes the following issue

  • CVE-2026-56968: improper sanitization of a short challenge in _gsasl_ntlm_client_step of the NTLM client can lead to memory disclosure (bsc#1268885).
Record
SUSE-SU-2026:22631-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gsasl
Debian:12
 before 2.2.0-1+deb12u2, plus listed versions
2.2.0-12.2.0-1+deb12u1
2.2.0-1+deb12u2
gsasl
Debian:13
 before 2.2.2-1.1+deb13u2, plus listed versions
2.2.2-1.12.2.2-1.1+deb13u1
2.2.2-1.1+deb13u2
gsasl
Debian:14
 before 2.2.4-1, plus listed versions
2.2.2-1.12.2.2-22.2.2-32.2.2-42.2.3-1
2.2.4-1
libgsasl
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 1.10.0-3.oe2403sp1
1.10.0-3.oe2403sp1
libgsasl
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 1.10.0-3.oe2403sp3
1.10.0-3.oe2403sp3
libgsasl
openEuler:20.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.8.1-3.oe2003sp4
1.8.1-3.oe2003sp4
libgsasl
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.8.1-3.oe2203sp4
1.8.1-3.oe2203sp4
libgsasl
openEuler:24.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.10.0-3.oe2403sp4
1.10.0-3.oe2403sp4
gsasl
SUSE:Linux Enterprise Server 16.0
 before 2.2.1-160000.4.1
2.2.1-160000.4.1
gsasl
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 2.2.1-160000.4.1
2.2.1-160000.4.1
Show 9 moreShow less
Affected packages
PackageAffectedFixed
gsasl
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.8.0-2ubuntu11.8.0-2ubuntu21.8.0-2ubuntu2+esm1
 None known
gsasl
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.8.0-8ubuntu11.8.0-8ubuntu21.8.0-8ubuntu2+esm1
 None known
gsasl
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.8.0-8ubuntu31.8.0-8ubuntu3+esm2
 None known
gsasl
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.8.0-8ubuntu31.8.1-11.8.1-1ubuntu0.1~esm1
 None known
gsasl
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.10.0-41.10.0-51.10.0-5ubuntu0.1~esm1
 None known
gsasl
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.2.0-2ubuntu12.2.0-2ubuntu22.2.1-1ubuntu12.2.1-1willsync12.2.1-1willsync1build12.2.1-1willsync1build22.2.1-1willsync1ubuntu0.1
 None known
gsasl
Ubuntu:25.10
 All versions, plus listed versions
2.2.1-1willsync1ubuntu12.2.2-2ubuntu12.2.2-2ubuntu1.1
 None known
gsasl
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.2.2-2ubuntu12.2.2-4ubuntu12.2.2-4ubuntu1.1
 None known
gsasl
openSUSE:Leap 16.0
 before 2.2.1-160000.4.1
2.2.1-160000.4.1

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-56968 is a low vulnerability (CVSS 3.7) in Gnu Sasl, published June 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in gsasl 2.2.0-1+deb12u2.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open