CVE-2026-48829 PUBLISHED

Assigner: mitre
Reserved: 24.05.2026 Published: 24.05.2026 Updated: 24.05.2026

In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	GNU
Product	GNU SASL
Versions	Default: unaffected affected from 0 to 2.2.3 (excl.)

References

https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00002.html
https://codeberg.org/gsasl/gsasl/commit/da9b5ae2962b014879e4a406c3b38f25aa70e97a
https://lists.debian.org/debian-security-announce/2026/msg00182.html
https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00000.html

Problem Types

CWE-476 NULL Pointer Dereference CWE