CVE-2026-48829 Details
Description
In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.
A NULL pointer dereference vulnerability has been identified in the DIGEST-MD5 implementation of GNU SASL, affecting versions prior to 2.2.3. This vulnerability arises from missing input validation in the DIGEST-MD5 parser, specifically in the 'lib/digest-md5/getsubopt.c' file. When a known token is received without an accompanying '=' character, the parser sets the value to NULL. This NULL value is then used by the parser's response handling functions, leading to a segmentation fault and process crash. The issue can be exploited by sending a malformed SASL response during the AUTHENTICATE exchange, causing applications that use GNU SASL for DIGEST-MD5 authentication to crash.
Users are advised to upgrade to GNU SASL version 2.2.3 or later, or to disable DIGEST-MD5 authentication. For those using Debian, the update is available in the Debian Security Advisory DSA-6271-1.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 24, 2026CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2026/06/msg00007.html | CVE | |
| https://codeberg.org/gsasl/gsasl/commit/da9b5ae2962b014879e4a406c3b38f25aa70e97a | [email protected] | Source CodeVendor |
| https://lists.debian.org/debian-security-announce/2026/msg00182.html | [email protected] | AdvisoryMailing ListRemedy |
| https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00000.html | [email protected] | ExploitIssue TrackingMailing ListRemedyTechnical DescriptionVendor |
| https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00002.html | [email protected] | AdvisoryMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GNU SASL | >= 0.0.0, <= 2.2.2 (semver) |
CPE
Remediation
| |
| Debian | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | CVE Modified | CVE |
| May 24, 2026 | New CVE Received | [email protected] |