# CVE-2026-48829: GNU SASL NULL pointer dereference in DIGEST-MD5 parser

Source: https://junglewise.ai/threats/cve-2026-48829-gnu-sasl-null-pointer-dereference-in-digest-md5-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-24. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-48829 · Severity: high · CVSS 7.5 · Published 2026-05-24

GNU SASL is a library used by applications to handle network authentication. A flaw in its DIGEST-MD5 mechanism allows an unauthenticated attacker to crash both client and server applications by sending a specially crafted authentication message. This results in a denial-of-service (DoS) condition, potentially disrupting email services or other systems relying on this library for secure logins.

Vendors: [GNU Project](https://junglewise.ai/threats/vendors/gnu-project).

## Quick answers

**Is CVE-2026-48829 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48829 being exploited in the wild.

**How severe is CVE-2026-48829?** High severity, with a CVSS score of 7.5, published 24 May 2026.

**Which products and versions are affected?** GNU Project SASL 0.0.0 through 2.2.2.

**Is there a fix for CVE-2026-48829?** A patch was published on 2026-05-13: GNU SASL version 2.2.3 released with fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48829 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48829?** Check whether you run GNU Project SASL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference exists in lib/digest-md5/getsubopt.c within GNU SASL (gsasl) versions prior to 2.2.3. The vulnerability is triggered when the DIGEST-MD5 parser encounters a known token (such as 'nonce') that is not followed by an equals sign ('='). In this scenario, the getsubopt function returns a NULL value pointer, which is subsequently passed to functions like strdup(), strlen(), or strcmp() in parser.c without validation. This affects both the server-side (parse_response) and client-side (parse_challenge) paths. An unauthenticated remote attacker can exploit this by sending a malformed SASL response during the authentication exchange, leading to a SIGSEGV and process crash. The issue is resolved in version 2.2.3 by ensuring the value pointer defaults to an empty string instead of NULL.

## Affected products

- GNU Project GNU SASL (gsasl) 0.0.0 through 2.2.2

## Timeline

- 2026-05-10: disclosed: Vulnerability reported by zhangph with PoC and suggested fix.
- 2026-05-13: patched: GNU SASL version 2.2.3 released with fix.
- 2026-05-13: advisory: Project maintainer released security advisory.
- 2026-05-14: patched: Debian released security updates (DSA 6271-1).
- 2026-05-24: advisory: CVE-2026-48829 published.

## References

- [https://codeberg.org/gsasl/gsasl/commit/da9b5ae2962b014879e4a406c3b38f25aa70e97a](https://codeberg.org/gsasl/gsasl/commit/da9b5ae2962b014879e4a406c3b38f25aa70e97a)
- [https://lists.debian.org/debian-security-announce/2026/msg00182.html](https://lists.debian.org/debian-security-announce/2026/msg00182.html)
- [https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00000.html](https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00000.html)
- [https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00002.html](https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00002.html)