https://seclists.org/oss-sec/2026/q4/122: Unfixed vulnerabilities in Cyrus SASL
Affected Software
Frequently Asked Questions
Which authentication mechanisms are implicated by the reported issues?
The listed reports involve SCRAM parsing, DIGEST-MD5 challenge handling, SRP server authentication, and CRAM-MD5 availability in a static-build scenario. Separate reports also identify memory leaks in _sasl_make_plain_secret and _sasl_auxprop_verify_apop.
Which report concerns an authentication-bypass condition?
The SRP report identifies a server authentication bypass when A equals 0 modulo N is not rejected. It is listed as issue #896 and references CWE-347.
Is there evidence of a current upstream release addressing these reports?
The provided information states that Cyrus SASL has had no new version since 2022. It also states that the only commits in the past year were documentation updates related to cyrus-imapd releases.
Are all listed reports directly memory-safety or authentication flaws?
No. One listed item describes a --with-pic static-build problem that registers zero SASL mechanisms, makes CRAM-MD5 unavailable, and produces a non-PIC libsasl2.a that cannot link into a PIE.