Is CVE-2026-107161 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107161 being exploited in the wild.

How severe is CVE-2026-107161?

High severity, with a CVSS score of 7.5, published 7 October 2026.

Which products and versions are affected?

Cyrus SASL versions shipped by Red Hat and other distributors.

How is CVE-2026-107161 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2026-107161?

Check whether you run Cyrus SASL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107161: Cyrus SASL heap buffer overflow in DIGEST-MD5

CVE-2026-107161 · Severity: high · CVSS 7.5 · Published 2026-10-07

Cyrus SASL is an authentication library used by mail and messaging systems to handle user authentication. A heap buffer overflow flaw in the DIGEST-MD5 authentication mechanism allows a malicious or on-path server to crash a client application by sending a specially crafted challenge. While code execution has not been demonstrated, this vulnerability can disrupt critical authentication-dependent services.

Vendors: Cyrus.

Quick answers

Is CVE-2026-107161 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107161 being exploited in the wild.
How severe is CVE-2026-107161?: High severity, with a CVSS score of 7.5, published 7 October 2026.
Which products and versions are affected?: Cyrus SASL versions shipped by Red Hat and other distributors.
Is there a fix for CVE-2026-107161?: No fixed version is recorded yet. Remove the optional cyrus-sasl-md5 package to eliminate the vulnerable DIGEST-MD5 and CRAM-MD5 plugins, or configure client applications to disable DIGEST-MD5 and HTTP Digest authentication, prioritizing GSSAPI or SCRAM instead. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-107161 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-107161?: Check whether you run Cyrus SASL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Remove the optional cyrus-sasl-md5 package to eliminate the vulnerable DIGEST-MD5 and CRAM-MD5 plugins, or configure client applications to disable DIGEST-MD5 and HTTP Digest authentication, prioritizing GSSAPI or SCRAM instead.

Technical details

The add_to_challenge() function in the DIGEST-MD5 plugin miscalculates buffer size before DIGEST-MD5 quoting is applied, then fails to recompute when quoting expands the value, leading to heap-based out-of-bounds write via strcat(). Attack requires a client to authenticate using DIGEST-MD5 or HTTP Digest against a malicious or on-path server. The demonstrated impact is client-side denial of service; code execution is theoretical and depends on heap state.

Affected products

Cyrus SASL versions shipped by Red Hat and other distributors

Timeline

2026-10-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.