A heap-based buffer overflow flaw was found in Cyrus SASL. (CVE-2026-107161)

The vulnerability in Cyrus SASL arises from improper buffer size calculation in the add_to_challenge() function of the DIGEST-MD5 plugin. Initially, the function computes the buffer size needed for a challenge/response field before applying DIGEST-MD5 quoting, which escapes special characters and can increase the length of the value. However, the function does not recompute the buffer size after quoting, resulting in an undersized buffer. When strcat() concatenates the quoted string into this buffer, it causes a heap-based out-of-bounds write. An attacker controlling a DIGEST-MD5 or HTTP Digest server can exploit this by sending a crafted challenge field such as realm or nonce, likely causing the client application to crash.

Successful exploitation can cause a heap-based buffer overflow leading to a crash of the client application. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). There is no known exploit in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, avoid connecting to untrusted DIGEST-MD5 or HTTP Digest servers and consider disabling the vulnerable DIGEST-MD5 plugin if feasible.