https://seclists.org/oss-sec/2026/q4/122: Unfixed vulnerabilities in Cyrus SASL
Published Oct 9, 2026
·Updated
Affected Software
1 affected component
Cyrus Cyrus SASL
The listed reports involve SCRAM parsing, DIGEST-MD5 challenge handling, SRP server authentication, and CRAM-MD5 availability in a static-build scenario. Separate reports also identify memory leaks in _sasl_make_plain_secret and _sasl_auxprop_verify_apop.
The SRP report identifies a server authentication bypass when A equals 0 modulo N is not rejected. It is listed as issue #896 and references CWE-347.
The provided information states that Cyrus SASL has had no new version since 2022. It also states that the only commits in the past year were documentation updates related to cyrus-imapd releases.
No. One listed item describes a --with-pic static-build problem that registers zero SASL mechanisms, makes CRAM-MD5 unavailable, and produces a non-PIC libsasl2.a that cannot link into a PIE.