# CVE-2026-107161: Cyrus SASL heap buffer overflow in DIGEST-MD5

Source: https://junglewise.ai/threats/cve-2026-107161-a-heap-based-buffer-overflow-flaw-was-found-in-cyrus-sasl-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-107161 · Severity: high · CVSS 7.5 · Published 2026-10-07

Cyrus SASL is an authentication library used by mail and messaging systems to handle user authentication. A heap buffer overflow flaw in the DIGEST-MD5 authentication mechanism allows a malicious or on-path server to crash a client application by sending a specially crafted challenge. While code execution has not been demonstrated, this vulnerability can disrupt critical authentication-dependent services.

Vendors: [Cyrus](https://junglewise.ai/threats/vendors/cyrus).

## Quick answers

**Is CVE-2026-107161 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107161 being exploited in the wild.

**How severe is CVE-2026-107161?** High severity, with a CVSS score of 7.5, published 7 October 2026.

**Which products and versions are affected?** Cyrus SASL versions shipped by Red Hat and other distributors.

**Is there a fix for CVE-2026-107161?** No fixed version is recorded yet. Remove the optional cyrus-sasl-md5 package to eliminate the vulnerable DIGEST-MD5 and CRAM-MD5 plugins, or configure client applications to disable DIGEST-MD5 and HTTP Digest authentication, prioritizing GSSAPI or SCRAM instead. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-107161 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-107161?** Check whether you run Cyrus SASL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Remove the optional cyrus-sasl-md5 package to eliminate the vulnerable DIGEST-MD5 and CRAM-MD5 plugins, or configure client applications to disable DIGEST-MD5 and HTTP Digest authentication, prioritizing GSSAPI or SCRAM instead.

## Technical details

The add_to_challenge() function in the DIGEST-MD5 plugin miscalculates buffer size before DIGEST-MD5 quoting is applied, then fails to recompute when quoting expands the value, leading to heap-based out-of-bounds write via strcat(). Attack requires a client to authenticate using DIGEST-MD5 or HTTP Digest against a malicious or on-path server. The demonstrated impact is client-side denial of service; code execution is theoretical and depends on heap state.

## Affected products

- Cyrus SASL versions shipped by Red Hat and other distributors

## Timeline

- 2026-10-07: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-107161](https://access.redhat.com/security/cve/CVE-2026-107161)