NULL Pointer Dereference Vulnerability in GNU SASL Affecting Clients and Servers

CVE-2026-48829

What is CVE-2026-48829?

In versions of GNU SASL prior to 2.2.3, a NULL pointer dereference vulnerability exists within the DIGEST-MD5 authentication mechanism. This issue arises when a known token lacks an accompanying '=' character, which can lead to unpredictable behavior in both client and server implementations. The vulnerability is located in the file lib/digest-md5/getsubopt.c, making it critical to update to the latest version to mitigate risks associated with this flaw. Users are advised to review their implementations and apply the necessary updates to prevent potential exploitation.

References