A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.

unity_linux UTSA-2026-146966: Unity Linux: cyrus-sasl (UTSA-2026-146966)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3290 advisory.

    A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-     MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting     is applied, but does not recompute that size when quoting (escaping special characters) makes the value     longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose     size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can     trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce,     most likely resulting in a crash of the client application. (CVE-2026-107161)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cyrus-sasl installed on the remote host is prior to 2.1.26-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4029 advisory.

    A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-     MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting     is applied, but does not recompute that size when quoting (escaping special characters) makes the value     longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose     size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can     trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce,     most likely resulting in a crash of the client application. (CVE-2026-107161)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22146-1 advisory.

    Security issue fixed:

    - CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash     or compromise       DIGEST-MD5 clients (bsc#1284687).

    Non security issues fixed:

    - Fix cyrus-sasl package failing to build with GCC 14 (bsc#1221863).
    - Replace insecure MD5 with ephemeral HMAC-SHA256 (bsc#1247498).
    - Make DIGEST-MD5 work with openssl3 (bsc#1230111).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4836-1 advisory.

    This update for cyrus-sasl fixes the following issue:

    - CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash     or compromise       DIGEST-MD5 clients (bsc#1284687).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:24266-1 advisory.

    Security issue fixed:

    - CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash     or compromise       DIGEST-MD5 clients (bsc#1284687).

    Non security issues fixed:

    - Fix cyrus-sasl package failing to build with GCC 14 (bsc#1221863).
    - Replace insecure MD5 with ephemeral HMAC-SHA256 (bsc#1247498).
    - Make DIGEST-MD5 work with openssl3 (bsc#1230111).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4795-1 advisory.

    This update for cyrus-sasl fixes the following issue:

    - CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash     or compromise       DIGEST-MD5 clients (bsc#1284687).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4802-1 advisory.

    This update for cyrus-sasl fixes the following issue:

    - CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash     or compromise       DIGEST-MD5 clients (bsc#1284687).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4817-1 advisory.

    This update for cyrus-sasl fixes the following issue:

    - CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash     or compromise       DIGEST-MD5 clients (bsc#1284687).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-     MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting     is applied, but does not recompute that size when quoting (escaping special characters) makes the value     longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose     size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can     trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce,     most likely resulting in a crash of the client application. (CVE-2026-107161)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
371841	Amazon Linux 2023 : cyrus-sasl, cyrus-sasl-devel, cyrus-sasl-gs2 (ALAS2023-2026-3290)	Nessus	Amazon Linux Local Security Checks	Local	high
371754	Amazon Linux 2 : cyrus-sasl (ALAS-2026-4029)	Nessus	Amazon Linux Local Security Checks	Local	high
371103	openSUSE 16: cyrus-sasl / cyrus-sasl-bdb / cyrus-sasl-bdb-crammd5 / etc (openSUSE-SU-2026:22146-1)	Nessus	SuSE Local Security Checks	Local	high
371090	SUSE SLED15: cyrus-sasl / cyrus-sasl-32bit / cyrus-sasl-bdb / etc (SUSE-SU-2026:4836-1)	Nessus	SuSE Local Security Checks	Local	high
371070	SUSE SLES16: cyrus-sasl / cyrus-sasl-crammd5 / cyrus-sasl-devel / etc (SUSE-SU-2026:24266-1)	Nessus	SuSE Local Security Checks	Local	high
370405	SUSE SLES12: cyrus-sasl / cyrus-sasl-32bit / cyrus-sasl-crammd5 / etc (SUSE-SU-2026:4795-1)	Nessus	SuSE Local Security Checks	Local	high
370383	SUSE SLES15: cyrus-sasl / cyrus-sasl-32bit / cyrus-sasl-bdb / etc (SUSE-SU-2026:4802-1)	Nessus	SuSE Local Security Checks	Local	high
370367	SUSE SLES15: cyrus-sasl / cyrus-sasl-32bit / cyrus-sasl-bdb / etc (SUSE-SU-2026:4817-1)	Nessus	SuSE Local Security Checks	Local	high
363959	Linux Distros Unpatched Vulnerability : CVE-2026-107161	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-107161

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high