Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
cyrus-sasl can crash or be compromised by bad server
published 14 days ago
Summary
The Cyrus SASL libraries used on SUSE systems can be triggered by a malicious server to overflow memory, which may cause the client to crash or allow an attacker to take control. This affects the standard Cyrus SASL package and its related database and authentication variants. Apply the latest SUSE security update to replace these libraries and protect your systems.
What to do
- Update suse cyrus-sasl to version 2.1.28-150500.3.12.1.
- Update suse cyrus-sasl-bdb to version 2.1.28-150500.3.12.1.
- Update suse cyrus-sasl-saslauthd to version 2.1.28-150500.3.12.1.
- Update suse cyrus-sasl-saslauthd-bdb to version 2.1.28-150500.3.12.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Micro 5.5 | suse | cyrus-sasl |
< 2.1.28-150500.3.12.1 Fix: upgrade to 2.1.28-150500.3.12.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | suse | cyrus-sasl |
< 2.1.28-150500.3.12.1 Fix: upgrade to 2.1.28-150500.3.12.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | suse | cyrus-sasl-bdb |
< 2.1.28-150500.3.12.1 Fix: upgrade to 2.1.28-150500.3.12.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | suse | cyrus-sasl-saslauthd |
< 2.1.28-150500.3.12.1 Fix: upgrade to 2.1.28-150500.3.12.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | suse | cyrus-sasl |
< 2.1.28-150500.3.12.1 Fix: upgrade to 2.1.28-150500.3.12.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | suse | cyrus-sasl-bdb |
< 2.1.28-150500.3.12.1 Fix: upgrade to 2.1.28-150500.3.12.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | suse | cyrus-sasl-saslauthd |
< 2.1.28-150500.3.12.1 Fix: upgrade to 2.1.28-150500.3.12.1
|
| SUSE:Linux Enterprise Server 15 SP5-LTSS | suse | cyrus-sasl |
< 2.1.28-150500.3.12.1 Fix: upgrade to 2.1.28-150500.3.12.1
|
| SUSE:Linux Enterprise Server 15 SP5-LTSS | suse | cyrus-sasl-bdb |
< 2.1.28-150500.3.12.1 Fix: upgrade to 2.1.28-150500.3.12.1
|
| SUSE:Linux Enterprise Server 15 SP5-LTSS | suse | cyrus-sasl-saslauthd |
< 2.1.28-150500.3.12.1 Fix: upgrade to 2.1.28-150500.3.12.1
|
| SUSE:Linux Enterprise Server 15 SP5-LTSS | suse | cyrus-sasl-saslauthd-bdb |
< 2.1.28-150500.3.12.1 Fix: upgrade to 2.1.28-150500.3.12.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | suse | cyrus-sasl |
< 2.1.28-150500.3.12.1 Fix: upgrade to 2.1.28-150500.3.12.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | suse | cyrus-sasl-bdb |
< 2.1.28-150500.3.12.1 Fix: upgrade to 2.1.28-150500.3.12.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | suse | cyrus-sasl-saslauthd |
< 2.1.28-150500.3.12.1 Fix: upgrade to 2.1.28-150500.3.12.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | suse | cyrus-sasl-saslauthd-bdb |
< 2.1.28-150500.3.12.1 Fix: upgrade to 2.1.28-150500.3.12.1
|
Original advisory text
Security update for cyrus-sasl
This update for cyrus-sasl fixes the following issue:
- CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise
DIGEST-MD5 clients (bsc#1284687).
- CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise
DIGEST-MD5 clients (bsc#1284687).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20264817-1/ Vendor Advisory
- https://bugzilla.suse.com/1284687 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-107161 URL
Timeline
Published21 Oct 2026
Updated21 Oct 2026
First seen21 Oct 2026
Sources
SUSE-SU-2026:4817-1 · OSV
Track software like this
Free during beta