Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
cyrus-sasl can let malicious server crash client
published 14 days ago
Summary
The Cyrus SASL libraries used on SUSE systems can be forced by a hostile server to overflow memory, causing the client application to stop working or be taken over. This affects the standard cyrus-sasl package and its related BDB and saslauthd variants. Apply the latest SUSE security update for these packages to protect your services.
What to do
- Update suse cyrus-sasl to version 2.1.27-150300.4.9.1.
- Update suse cyrus-sasl-bdb to version 2.1.27-150300.4.9.1.
- Update suse cyrus-sasl-saslauthd to version 2.1.27-150300.4.9.1.
- Update suse cyrus-sasl-saslauthd-bdb to version 2.1.27-150300.4.9.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Micro 5.3 | suse | cyrus-sasl |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
| SUSE:Linux Enterprise Micro 5.4 | suse | cyrus-sasl |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | suse | cyrus-sasl |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | suse | cyrus-sasl-bdb |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | suse | cyrus-sasl-saslauthd |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | suse | cyrus-sasl-saslauthd-bdb |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | suse | cyrus-sasl |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | suse | cyrus-sasl-bdb |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | suse | cyrus-sasl-saslauthd |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | suse | cyrus-sasl-saslauthd-bdb |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
| SUSE:Linux Enterprise Server 15 SP4-LTSS | suse | cyrus-sasl |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
| SUSE:Linux Enterprise Server 15 SP4-LTSS | suse | cyrus-sasl-bdb |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
| SUSE:Linux Enterprise Server 15 SP4-LTSS | suse | cyrus-sasl-saslauthd |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
| SUSE:Linux Enterprise Server 15 SP4-LTSS | suse | cyrus-sasl-saslauthd-bdb |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | suse | cyrus-sasl |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | suse | cyrus-sasl-bdb |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | suse | cyrus-sasl-saslauthd |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | suse | cyrus-sasl-saslauthd-bdb |
< 2.1.27-150300.4.9.1 Fix: upgrade to 2.1.27-150300.4.9.1
|
Original advisory text
Security update for cyrus-sasl
This update for cyrus-sasl fixes the following issue:
- CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise
DIGEST-MD5 clients (bsc#1284687).
- CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise
DIGEST-MD5 clients (bsc#1284687).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20264802-1/ Vendor Advisory
- https://bugzilla.suse.com/1284687 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-107161 URL
Timeline
Published21 Oct 2026
Updated21 Oct 2026
First seen21 Oct 2026
Sources
SUSE-SU-2026:4802-1 · OSV
Track software like this
Free during beta