REDHAT-BUG-2523232: Buffer Overflow
Heap buffer overflow in sasliorecv() via padded SASL UNBIND fix introduced state bug in that approach. The copy clamps the size, but it does not advance the buffered offset. On the next receive the server waits for another complete N bytes instead of returning the already-buffered remainder (N - len).
Example: a 562-byte UNBIND with the default 512-byte connection buffer returns 512 bytes, then waits for 562 new bytes rather than the remaining 50. A remote SASL-authenticated client can leave the socket open, so the connection stays stalled until the I/O timeout. Repeated connections could be a resource-exhaustion / DoS vector.
CVE-2026-11610 - incomplete fix may introduce a connection-stall DoS
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to do to trigger the connection stall?
The attacker must be a remote client that has authenticated using SASL. They can send a padded SASL UNBIND larger than the connection buffer and keep the socket open after the first buffered portion is returned.
Are default settings affected?
Yes. The described example uses the default 512-byte connection buffer: a 562-byte UNBIND returns 512 bytes and leaves the server waiting for 562 new bytes instead of processing the remaining 50 bytes already buffered.
What is the practical impact of repeated exploitation?
Each affected connection can remain stalled until the I/O timeout. Repeated SASL-authenticated connections may therefore consume resources and create a denial-of-service condition.