In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4618 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4618-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     June 05, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : gsasl     Version        : 1.10.0-4+deb11u2     CVE ID         : CVE-2026-48829


    It was discovered that missing input sanitising in the DIGEST-MD5 parser     of the GNU SASL library could result in denial of service.


    For Debian 11 bullseye, this problem has been fixed in version     1.10.0-4+deb11u2.

    We recommend that you upgrade your gsasl packages.

    For the detailed security status of gsasl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gsasl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8356-1 advisory.

    It was discovered that GNU SASL did not properly handle certain DIGEST-MD5 tokens. An attacker could     possibly use this issue to cause GNU SASL to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers,     via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.
    (CVE-2026-48829)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
318855	Debian dla-4618 : gsasl - security update	Nessus	Debian Local Security Checks	high
318272	Ubuntu 24.04 LTS / 25.10 / 26.04 LTS : GNU SASL vulnerability (USN-8356-1)	Nessus	Ubuntu Local Security Checks	high
316646	Linux Distros Unpatched Vulnerability : CVE-2026-48829	Nessus	Misc.	high

Detections

Analytics

CVE-2026-48829

high

Tenable Plugins

high

high

high