Executive brief
GNU SASL is a library used by applications to handle network authentication. A flaw in its DIGEST-MD5 mechanism allows an unauthenticated attacker to crash both client and server applications by sending a specially crafted authentication message. This results in a denial-of-service (DoS) condition, potentially disrupting email services or other systems relying on this library for secure logins.
Technical details
A NULL pointer dereference exists in lib/digest-md5/getsubopt.c within GNU SASL (gsasl) versions prior to 2.2.3. The vulnerability is triggered when the DIGEST-MD5 parser encounters a known token (such as 'nonce') that is not followed by an equals sign ('='). In this scenario, the getsubopt function returns a NULL value pointer, which is subsequently passed to functions like strdup(), strlen(), or strcmp() in parser.c without validation. This affects both the server-side (parse_response) and client-side (parse_challenge) paths. An unauthenticated remote attacker can exploit this by sending a malformed SASL response during the authentication exchange, leading to a SIGSEGV and process crash. The issue is resolved in version 2.2.3 by ensuring the value pointer defaults to an empty string instead of NULL.
Affected products
- GNU Project GNU SASL (gsasl) 0.0.0 through 2.2.2
Timeline
- 2026-05-10: disclosed: Vulnerability reported by zhangph with PoC and suggested fix.
- 2026-05-13: patched: GNU SASL version 2.2.3 released with fix.
- 2026-05-13: advisory: Project maintainer released security advisory.
- 2026-05-14: patched: Debian released security updates (DSA 6271-1).
- 2026-05-24: advisory: CVE-2026-48829 published.