CVE-2026-48829

HighCVSS 7.5

Published: 24/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

37th percentile - higher than 37% of all known CVEs

Summary

In GNU SASL before version 2.2.3, the DIGEST-MD5 mechanism has a NULL pointer dereference affecting both clients and servers, triggered by a known token without an accompanying = character. This occurs in lib/digest-md5/getsubopt.c.

Risk Assessment

This vulnerability can cause application crashes (denial of service) on both client and server sides, potentially disrupting authentication services.

Recommendation

Update GNU SASL to version 2.2.3 or later, which includes the fix.

Other vulnerabilities in GNU SASL

CVE-2026-56968Low
In GNU SASL before version 2.2.4, there is a lack of sanitization of a short challenge in the _gsasl_ntlm_client_step function in the NTLM client, which could result in memory disclosure via a crafted server.

Original NVD description (English source)

In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.