{"id":"CVE-2026-107161","aliases":["AZL-107297","AZL-107300","BELL-CVE-2026-107161","CLSA-2026-1792928909","DEBIAN-CVE-2026-107161","EUVD-2026-94582","GHSA-4jhc-cc62-fwcm","OESA-2026-4300","OESA-2026-4301","OESA-2026-4302","OESA-2026-4303","ROOT-OS-DEBIAN-12-CVE-2026-107161","ROOT-OS-DEBIAN-13-CVE-2026-107161","SUSE-SU-2026:24266-1","SUSE-SU-2026:24380-1","SUSE-SU-2026:24405-1","SUSE-SU-2026:4795-1","SUSE-SU-2026:4802-1","SUSE-SU-2026:4817-1","SUSE-SU-2026:4836-1","UBUNTU-CVE-2026-107161","openSUSE-SU-2026:12099-1","openSUSE-SU-2026:22146-1"],"status":"published","title":"Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00376,"percentile":0.31985,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-10-07T19:29:28Z","modified":"2026-11-11T07:30:07Z","fixes":[{"ecosystem":"Alpaquita:23","package":"cyrus-sasl","fixed_in":["2.1.28-r4"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"cyrus-sasl","fixed_in":["2.1.28-r10"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"cyrus-sasl","fixed_in":["2.1.28-r11"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"cyrus-sasl2-doc","fixed_in":["2.1.27+dfsg-1+deb10u2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libsasl2-2","fixed_in":["2.1.27+dfsg-1+deb10u2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libsasl2-dev","fixed_in":["2.1.27+dfsg-1+deb10u2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libsasl2-modules","fixed_in":["2.1.27+dfsg-1+deb10u2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libsasl2-modules-db","fixed_in":["2.1.27+dfsg-1+deb10u2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libsasl2-modules-gssapi-heimdal","fixed_in":["2.1.27+dfsg-1+deb10u2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libsasl2-modules-gssapi-mit","fixed_in":["2.1.27+dfsg-1+deb10u2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libsasl2-modules-ldap","fixed_in":["2.1.27+dfsg-1+deb10u2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libsasl2-modules-otp","fixed_in":["2.1.27+dfsg-1+deb10u2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libsasl2-modules-sql","fixed_in":["2.1.27+dfsg-1+deb10u2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"sasl2-bin","fixed_in":["2.1.27+dfsg-1+deb10u2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cyrus-sasl2","fixed_in":["2.1.28+dfsg-10+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cyrus-sasl2","fixed_in":["2.1.28+dfsg1-12"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"cyrus-sasl","fixed_in":["2.1.28-12.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"cyrus-sasl","fixed_in":["2.1.28-7.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"cyrus-sasl","fixed_in":["2.1.28-12.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"cyrus-sasl","fixed_in":["2.1.28-12.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"cyrus-sasl2","fixed_in":["2.1.28+dfsg1-9.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-cyrus-sasl2","fixed_in":["2.1.28+dfsg1-9.aikido.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cyrus-sasl","fixed_in":["2.1.28-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cyrus-sasl-saslauthd","fixed_in":["2.1.28-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cyrus-sasl","fixed_in":["2.1.28-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cyrus-sasl-saslauthd","fixed_in":["2.1.28-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"cyrus-sasl","fixed_in":["2.1.28-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"cyrus-sasl","fixed_in":["2.1.28-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"cyrus-sasl","fixed_in":["2.1.26-14.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"cyrus-sasl-saslauthd","fixed_in":["2.1.26-14.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cyrus-sasl","fixed_in":["2.1.26-14.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cyrus-sasl-saslauthd","fixed_in":["2.1.26-14.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"cyrus-sasl","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"cyrus-sasl","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cyrus-sasl","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cyrus-sasl-bdb","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cyrus-sasl-saslauthd","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cyrus-sasl-saslauthd-bdb","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cyrus-sasl","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cyrus-sasl-bdb","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cyrus-sasl-saslauthd","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cyrus-sasl-saslauthd-bdb","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cyrus-sasl","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cyrus-sasl-bdb","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cyrus-sasl-saslauthd","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cyrus-sasl-saslauthd-bdb","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cyrus-sasl","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cyrus-sasl-bdb","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cyrus-sasl-saslauthd","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cyrus-sasl-saslauthd-bdb","fixed_in":["2.1.27-150300.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"cyrus-sasl","fixed_in":["2.1.28-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cyrus-sasl","fixed_in":["2.1.28-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cyrus-sasl-bdb","fixed_in":["2.1.28-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cyrus-sasl-saslauthd","fixed_in":["2.1.28-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cyrus-sasl","fixed_in":["2.1.28-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cyrus-sasl-bdb","fixed_in":["2.1.28-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cyrus-sasl-saslauthd","fixed_in":["2.1.28-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cyrus-sasl","fixed_in":["2.1.28-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cyrus-sasl-bdb","fixed_in":["2.1.28-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cyrus-sasl-saslauthd","fixed_in":["2.1.28-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cyrus-sasl-saslauthd-bdb","fixed_in":["2.1.28-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cyrus-sasl","fixed_in":["2.1.28-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cyrus-sasl-bdb","fixed_in":["2.1.28-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cyrus-sasl-saslauthd","fixed_in":["2.1.28-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cyrus-sasl-saslauthd-bdb","fixed_in":["2.1.28-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cyrus-sasl","fixed_in":["2.1.28-150600.7.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cyrus-sasl-saslauthd","fixed_in":["2.1.28-150600.7.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"cyrus-sasl-bdb","fixed_in":["2.1.28-150600.7.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"cyrus-sasl-saslauthd-bdb","fixed_in":["2.1.28-150600.7.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"cyrus-sasl-bdb","fixed_in":["2.1.28-150600.7.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"cyrus-sasl-saslauthd","fixed_in":["2.1.28-150600.7.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cyrus-sasl","fixed_in":["2.1.28-150600.7.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cyrus-sasl-bdb","fixed_in":["2.1.28-150600.7.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cyrus-sasl-saslauthd","fixed_in":["2.1.28-150600.7.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cyrus-sasl-saslauthd-bdb","fixed_in":["2.1.28-150600.7.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cyrus-sasl","fixed_in":["2.1.28-150600.7.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cyrus-sasl-bdb","fixed_in":["2.1.28-150600.7.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cyrus-sasl-saslauthd","fixed_in":["2.1.28-150600.7.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cyrus-sasl-saslauthd-bdb","fixed_in":["2.1.28-150600.7.17.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cyrus-sasl","fixed_in":["2.1.28-13.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"cyrus-sasl","fixed_in":["2.1.28-160000.4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"cyrus-sasl-bdb","fixed_in":["2.1.28-160000.4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"cyrus-sasl-saslauthd","fixed_in":["2.1.28-160000.4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"cyrus-sasl-saslauthd-bdb","fixed_in":["2.1.28-160000.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.28-8"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cyrus-sasl-bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.28-8"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.28-r3"},{"fixed":"2.1.28-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.28-r9"},{"fixed":"2.1.28-r10"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.28-r2"},{"fixed":"2.1.28-r11"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"cyrus-sasl2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27+dfsg-1+deb10u2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libsasl2-2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27+dfsg-1+deb10u2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libsasl2-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27+dfsg-1+deb10u2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libsasl2-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27+dfsg-1+deb10u2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libsasl2-modules-db","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27+dfsg-1+deb10u2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libsasl2-modules-gssapi-heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27+dfsg-1+deb10u2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libsasl2-modules-gssapi-mit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27+dfsg-1+deb10u2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libsasl2-modules-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27+dfsg-1+deb10u2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libsasl2-modules-otp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27+dfsg-1+deb10u2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libsasl2-modules-sql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27+dfsg-1+deb10u2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"sasl2-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27+dfsg-1+deb10u2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cyrus-sasl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28+dfsg-10+deb12u1"}]}],"versions":["2.1.28+dfsg-10"]},{"source":"osv","ecosystem":"Debian:13","package":"cyrus-sasl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.28+dfsg1-10","2.1.28+dfsg1-11","2.1.28+dfsg1-12","2.1.28+dfsg1-9"]},{"source":"osv","ecosystem":"Debian:14","package":"cyrus-sasl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28+dfsg1-12"}]}],"versions":["2.1.28+dfsg1-10","2.1.28+dfsg1-11","2.1.28+dfsg1-9"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-12.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-7.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-12.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-12.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"cyrus-sasl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28+dfsg1-9.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-cyrus-sasl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28+dfsg1-9.aikido.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cyrus-sasl-saslauthd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cyrus-sasl-saslauthd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.26-14.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"cyrus-sasl-saslauthd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.26-14.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.26-14.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cyrus-sasl-saslauthd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.26-14.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cyrus-sasl-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cyrus-sasl-saslauthd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cyrus-sasl-saslauthd-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cyrus-sasl-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cyrus-sasl-saslauthd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cyrus-sasl-saslauthd-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cyrus-sasl-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cyrus-sasl-saslauthd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cyrus-sasl-saslauthd-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cyrus-sasl-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cyrus-sasl-saslauthd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cyrus-sasl-saslauthd-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-150300.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cyrus-sasl-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cyrus-sasl-saslauthd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cyrus-sasl-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cyrus-sasl-saslauthd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cyrus-sasl-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cyrus-sasl-saslauthd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cyrus-sasl-saslauthd-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cyrus-sasl-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cyrus-sasl-saslauthd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cyrus-sasl-saslauthd-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150600.7.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cyrus-sasl-saslauthd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150600.7.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"cyrus-sasl-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150600.7.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"cyrus-sasl-saslauthd-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150600.7.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"cyrus-sasl-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150600.7.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"cyrus-sasl-saslauthd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150600.7.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150600.7.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cyrus-sasl-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150600.7.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cyrus-sasl-saslauthd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150600.7.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cyrus-sasl-saslauthd-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150600.7.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150600.7.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cyrus-sasl-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150600.7.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cyrus-sasl-saslauthd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150600.7.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cyrus-sasl-saslauthd-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-150600.7.17.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cyrus-sasl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.25.dfsg1-17","2.1.25.dfsg1-17build1","2.1.25.dfsg1-17ubuntu0.1~esm1","2.1.25.dfsg1-17ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cyrus-sasl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.26.dfsg1-14","2.1.26.dfsg1-14build1","2.1.26.dfsg1-14ubuntu0.1","2.1.26.dfsg1-14ubuntu0.2","2.1.26.dfsg1-14ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cyrus-sasl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.27~101-g0780600+dfsg-3ubuntu1","2.1.27~101-g0780600+dfsg-3ubuntu2","2.1.27~101-g0780600+dfsg-3ubuntu2.1","2.1.27~101-g0780600+dfsg-3ubuntu2.3","2.1.27~101-g0780600+dfsg-3ubuntu2.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cyrus-sasl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.27+dfsg-1build3","2.1.27+dfsg-2","2.1.27+dfsg-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cyrus-sasl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.27+dfsg-2.1build1","2.1.27+dfsg-2.2","2.1.27+dfsg-2.3","2.1.27+dfsg2-1","2.1.27+dfsg2-2","2.1.27+dfsg2-2build1","2.1.27+dfsg2-2ubuntu1","2.1.27+dfsg2-3","2.1.27+dfsg2-3ubuntu1","2.1.27+dfsg2-3ubuntu1.1","2.1.27+dfsg2-3ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cyrus-sasl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.28+dfsg1-3","2.1.28+dfsg1-4","2.1.28+dfsg1-5ubuntu1","2.1.28+dfsg1-5ubuntu2","2.1.28+dfsg1-5ubuntu3","2.1.28+dfsg1-5ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cyrus-sasl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.28+dfsg1-9ubuntu3","2.1.28+dfsg1-9ubuntu4","2.1.28+dfsg1-11ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cyrus-sasl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.28+dfsg1-9ubuntu1","2.1.28+dfsg1-9ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-160000.4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cyrus-sasl-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-160000.4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cyrus-sasl-saslauthd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-160000.4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cyrus-sasl-saslauthd-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.28-160000.4.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-107161","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460420","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/09/20"},{"url":"https://lists.debian.org/debian-lts-announce/2026/10/msg00064.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-4jhc-cc62-fwcm"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-107161","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1792928909.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-107161","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4300","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4301","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4302","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4303","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624266-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1221863","tags":["report"]},{"url":"https://bugzilla.suse.com/1230111","tags":["report"]},{"url":"https://bugzilla.suse.com/1247498","tags":["report"]},{"url":"https://bugzilla.suse.com/1284687","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107161","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624380-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1233529","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624405-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264795-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264802-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264817-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264836-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-107161","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107161","tags":["report"]},{"url":"https://github.com/cyrusimap/cyrus-sasl/pull/892","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-107161","title":"Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.","status":"published","published":"2026-10-07T19:29:28.164Z","modified":"2026-11-06T07:39:56.565Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-06T08:57:32.08691Z"}],"euvd":[{"id":"EUVD-2026-94582","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.","status":"published","published":"2026-10-07T19:29:28Z","modified":"2026-11-06T07:39:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T09:04:28.113071Z"}],"ghsa":[{"id":"GHSA-4jhc-cc62-fwcm","title":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the...","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.","status":"published","published":"2026-10-07T21:33:29Z","modified":"2026-10-30T21:31:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:14:52.597654Z"}],"nvd":[{"id":"CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.","status":"published","published":"2026-10-07T20:17:10.977Z","modified":"2026-11-06T08:17:17.55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-06T11:59:57.419913Z"}],"osv":[{"id":"BELL-CVE-2026-107161","status":"published","published":"2026-10-08T06:05:43.6942Z","modified":"2026-11-11T07:30:07.257428757Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T07:56:32.232974Z"},{"id":"DEBIAN-CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.","status":"published","published":"2026-10-07T20:17:10.977Z","modified":"2026-11-07T09:47:30.144445527Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"OESA-2026-4300","title":"cyrus-sasl security update","description":"The  package contains the Cyrus implementation of SASL. SASL is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols.\r\n\r\nSecurity Fix(es):\n\nA heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.(CVE-2026-107161)","status":"published","published":"2026-10-16T11:59:06Z","modified":"2026-10-16T12:15:18.164432088Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4301","title":"cyrus-sasl security update","description":"The  package contains the Cyrus implementation of SASL. SASL is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols.\r\n\r\nSecurity Fix(es):\n\nA heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.(CVE-2026-107161)","status":"published","published":"2026-10-16T11:59:07Z","modified":"2026-10-16T12:15:18.162895224Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4302","title":"cyrus-sasl security update","description":"The  package contains the Cyrus implementation of SASL. SASL is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols.\r\n\r\nSecurity Fix(es):\n\nA heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.(CVE-2026-107161)","status":"published","published":"2026-10-16T11:59:08Z","modified":"2026-10-16T12:15:18.166047439Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4303","title":"cyrus-sasl security update","description":"The  package contains the Cyrus implementation of SASL. SASL is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols.\r\n\r\nSecurity Fix(es):\n\nA heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.(CVE-2026-107161)","status":"published","published":"2026-10-16T11:59:08Z","modified":"2026-10-16T12:15:18.167378359Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.","status":"published","published":"2026-10-07T20:17:00Z","modified":"2026-10-17T12:58:01.212134043Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"AZL-107297","title":"CVE-2026-107161 affecting package cyrus-sasl 2.1.28-8","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.","status":"published","published":"2026-10-07T20:17:10Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107300","title":"CVE-2026-107161 affecting package cyrus-sasl-bootstrap 2.1.28-8","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.","status":"published","published":"2026-10-07T20:17:10Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"CLSA-2026-1792928909","title":"Fix CVE(s): CVE-2026-107161","description":"   * SECURITY UPDATE: Heap buffer overflow in DIGEST-MD5 add_to_challenge()\n     - debian/patches/0024-CVE-2026-107161.patch: recompute the required\n       buffer size after quoting the value in plugins/digestmd5.c\n     - CVE-2026-107161","status":"published","published":"2026-10-25T11:48:40Z","modified":"2026-10-26T09:31:53.727544568Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"openSUSE-SU-2026:12099-1","title":"cyrus-sasl-2.1.28-13.1 on GA media","description":"These are all security issues fixed in the cyrus-sasl-2.1.28-13.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-10T00:00:00Z","modified":"2026-10-11T12:45:03.863138905Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22146-1","title":"Security update for cyrus-sasl","description":"This update for cyrus-sasl fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise\n  DIGEST-MD5 clients (bsc#1284687).\n\nNon security issues fixed:\n\n- Fix cyrus-sasl package failing to build with GCC 14 (bsc#1221863).\n- Replace insecure MD5 with ephemeral HMAC-SHA256 (bsc#1247498).\n- Make DIGEST-MD5 work with openssl3 (bsc#1230111).\n","status":"published","published":"2026-10-21T05:47:26Z","modified":"2026-10-23T17:23:12.253476889Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-107161","title":"CVE-2026-107161 in cyrus-sasl2 - Patched by Root","description":"Root has patched CVE-2026-107161 in the cyrus-sasl2 package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-10-16T07:04:32Z","modified":"2026-11-02T13:00:04.985005909Z","updated_at":"2026-11-02T15:53:31.773105Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-107161","title":"CVE-2026-107161 in cyrus-sasl2 - Patched by Root","description":"Root has patched CVE-2026-107161 in the cyrus-sasl2 package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-10-16T07:07:14Z","modified":"2026-10-16T08:15:10.112579889Z","updated_at":"2026-11-02T15:53:33.153539Z"},{"id":"SUSE-SU-2026:24266-1","title":"Security update for cyrus-sasl","description":"This update for cyrus-sasl fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise\n  DIGEST-MD5 clients (bsc#1284687).\n\nNon security issues fixed:\n\n- Fix cyrus-sasl package failing to build with GCC 14 (bsc#1221863).\n- Replace insecure MD5 with ephemeral HMAC-SHA256 (bsc#1247498).\n- Make DIGEST-MD5 work with openssl3 (bsc#1230111).\n","status":"published","published":"2026-10-21T05:49:58Z","modified":"2026-10-23T17:23:10.742313541Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24380-1","title":"Security update for cyrus-sasl","description":"This update for cyrus-sasl fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise\n  DIGEST-MD5 clients (bsc#1284687).\n\nNon security issues fixed:\n\n- Fix cyrus-sasl package failing to build with GCC 14 (bsc#1221863).\n- Replace insecure MD5 with ephemeral HMAC-SHA256 (bsc#1247498).\n- Make DIGEST-MD5 work with openssl3 (bsc#1230111).\n","status":"published","published":"2026-10-22T07:36:10Z","modified":"2026-10-27T17:23:19.463138995Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24405-1","title":"Security update for cyrus-sasl","description":"This update for cyrus-sasl fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise\n  DIGEST-MD5 clients (bsc#1284687).\n\nNon security issues fixed:\n\n- Fix cyrus-sasl package failing to build with GCC 14 (bsc#1221863).\n- Replace insecure MD5 with ephemeral HMAC-SHA256 (bsc#1247498).\n- Make DIGEST-MD5 work with openssl3 (bsc#1230111).\n","status":"published","published":"2026-10-21T05:49:58Z","modified":"2026-10-30T17:23:16.055421717Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4795-1","title":"Security update for cyrus-sasl","description":"This update for cyrus-sasl fixes the following issue:\n\n- CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise\n  DIGEST-MD5 clients (bsc#1284687).\n","status":"published","published":"2026-10-21T07:52:52Z","modified":"2026-10-21T20:02:15.440963317Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4802-1","title":"Security update for cyrus-sasl","description":"This update for cyrus-sasl fixes the following issue:\n\n- CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise\n  DIGEST-MD5 clients (bsc#1284687).\n","status":"published","published":"2026-10-21T07:58:38Z","modified":"2026-10-21T20:02:16.075217938Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4817-1","title":"Security update for cyrus-sasl","description":"This update for cyrus-sasl fixes the following issue:\n\n- CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise\n  DIGEST-MD5 clients (bsc#1284687).\n","status":"published","published":"2026-10-21T10:12:39Z","modified":"2026-10-21T20:02:14.278372196Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4836-1","title":"Security update for cyrus-sasl","description":"This update for cyrus-sasl fixes the following issue:\n\n- CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise\n  DIGEST-MD5 clients (bsc#1284687).\n","status":"published","published":"2026-10-21T12:52:40Z","modified":"2026-10-22T11:45:03.616994208Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}