Is CVE-2026-48829 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48829 being exploited in the wild.

How severe is CVE-2026-48829?

High severity, with a CVSS score of 7.5, published 24 May 2026.

Which products and versions are affected?

GNU Project SASL 0.0.0 through 2.2.2.

Is there a fix for CVE-2026-48829?

A patch was published on 2026-05-13: GNU SASL version 2.2.3 released with fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48829 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48829?

Check whether you run GNU Project SASL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48829: GNU SASL NULL pointer dereference in DIGEST-MD5 parser

CVE-2026-48829 · Severity: high · CVSS 7.5 · Published 2026-05-24

GNU SASL is a library used by applications to handle network authentication. A flaw in its DIGEST-MD5 mechanism allows an unauthenticated attacker to crash both client and server applications by sending a specially crafted authentication message. This results in a denial-of-service (DoS) condition, potentially disrupting email services or other systems relying on this library for secure logins.

Vendors: GNU Project.

Quick answers

Is CVE-2026-48829 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48829 being exploited in the wild.
How severe is CVE-2026-48829?: High severity, with a CVSS score of 7.5, published 24 May 2026.
Which products and versions are affected?: GNU Project SASL 0.0.0 through 2.2.2.
Is there a fix for CVE-2026-48829?: A patch was published on 2026-05-13: GNU SASL version 2.2.3 released with fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48829 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48829?: Check whether you run GNU Project SASL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference exists in lib/digest-md5/getsubopt.c within GNU SASL (gsasl) versions prior to 2.2.3. The vulnerability is triggered when the DIGEST-MD5 parser encounters a known token (such as 'nonce') that is not followed by an equals sign ('='). In this scenario, the getsubopt function returns a NULL value pointer, which is subsequently passed to functions like strdup(), strlen(), or strcmp() in parser.c without validation. This affects both the server-side (parse_response) and client-side (parse_challenge) paths. An unauthenticated remote attacker can exploit this by sending a malformed SASL response during the authentication exchange, leading to a SIGSEGV and process crash. The issue is resolved in version 2.2.3 by ensuring the value pointer defaults to an empty string instead of NULL.

Affected products

GNU Project GNU SASL (gsasl) 0.0.0 through 2.2.2

Timeline

2026-05-10: disclosed: Vulnerability reported by zhangph with PoC and suggested fix.
2026-05-13: patched: GNU SASL version 2.2.3 released with fix.
2026-05-13: advisory: Project maintainer released security advisory.
2026-05-14: patched: Debian released security updates (DSA 6271-1).
2026-05-24: advisory: CVE-2026-48829 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.