https://github.com/cyrusimap/cyrus-sasl/issues/891 points out there are a number of publicly reported security issues in the Cyrus SASL project, with no response from maintainers, other than former maintainers saying they are no longer involved; no new version since 2022, and the only commits in the past year being doc updates to note cyrus-imapd releases.

The listed open security issues are:

Memory leaks in saslmakeplainsecret and saslauxpropverifyapop, lib/checkpw.c #887 - https://github.com/cyrusimap/cyrus-sasl/issues/887

[VS-CSASL-2026-0001] - 1-Byte Heap Out-of-Bounds Read in Cyrus SASL SCRAM GS2 Header Parser #888 - https://github.com/cyrusimap/cyrus-sasl/issues/888

[Security] Heap Buffer Overflow in DIGEST-MD5 addtochallenge()doc (plugins/digestmd5.c) and others #889 - https://github.com/cyrusimap/cyrus-sasl/issues/889

--with-pic static build registers zero SASL mechanisms and yields a non-PIC libsasl2.a (CRAM-MD5 unavailable; won't link into a PIE) #895 - https://github.com/cyrusimap/cyrus-sasl/issues/895

[Security] SRP server authentication bypass: A == 0 (mod N) not rejected (CWE-347) #896 - https://github.com/cyrusimap/cyrus-sasl/issues/887

Only one of these appears to have been assigned a CVE id so far - Red Hat assigned CVE-2026-107161 for https://bugzilla.redhat.com/showbug.cgi?id=2460420 which seems to match https://github.com/cyrusimap/cyrus-sasl/issues/889 (or perhaps be an independent finding of the same issue?)

-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris