CVE-2026-48829 - Vulnerability Details - OpenCVE

In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Gnu	Gnu Sasl

No data.

No data.

References

Link	Providers
https://codeberg.org/gsasl/gsasl/commit/da9b5ae2962b014879e4a406c3b38f25aa70e97a
https://lists.debian.org/debian-security-announce/2026/msg00182.html
https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00000.html
https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00002.html

History

Tue, 26 May 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sun, 24 May 2026 04:45:00 +0000

Type	Values Removed	Values Added
Title		NULL Pointer Dereference in DIGEST-MD5 Handling of GNU SASL 2.2.3 and Earlier

Sun, 24 May 2026 03:30:00 +0000

Type	Values Removed	Values Added
Description		In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.
First Time appeared		Gnu Gnu gnu Sasl
Weaknesses		CWE-476
CPEs		cpe:2.3:a:gnu:gnu_sasl::::::::
Vendors & Products		Gnu Gnu gnu Sasl
References		https://codeberg.org/gsasl/gsasl/commit/da9b5ae2962b014879e4a406c3b38f25aa70e97a https://lists.debian.org/debian-security-announce/2026/msg00182.html https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00000.html https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00002.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-05-24T02:22:04.403Z

Updated: 2026-05-26T15:21:29.987Z

Reserved: 2026-05-24T02:22:03.024Z

Link: CVE-2026-48829

Vulnrichment

Updated: 2026-05-26T15:21:24.856Z

NVD

Status : Deferred

Published: 2026-05-24T04:16:39.150

Modified: 2026-05-26T20:19:21.240

Link: CVE-2026-48829

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2026-48829", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-05-24T02:22:03.024Z", "datePublished": "2026-05-24T02:22:04.403Z", "dateUpdated": "2026-05-26T15:21:29.987Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "GNU SASL", "vendor": "GNU", "versions": [{"lessThan": "2.2.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-05-24T02:33:58.822Z"}, "references": [{"url": "https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00002.html"}, {"url": "https://codeberg.org/gsasl/gsasl/commit/da9b5ae2962b014879e4a406c3b38f25aa70e97a"}, {"url": "https://lists.debian.org/debian-security-announce/2026/msg00182.html"}, {"url": "https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00000.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gnu:gnu_sasl:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.2.3"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T15:07:48.596630Z", "id": "CVE-2026-48829", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T15:21:29.987Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48829", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T15:07:48.596630Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T15:21:24.856Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GNU", "product": "GNU SASL", "versions": [{"status": "affected", "version": "0", "lessThan": "2.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00002.html"}, {"url": "https://codeberg.org/gsasl/gsasl/commit/da9b5ae2962b014879e4a406c3b38f25aa70e97a"}, {"url": "https://lists.debian.org/debian-security-announce/2026/msg00182.html"}, {"url": "https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00000.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnu:gnu_sasl:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.2.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-05-24T02:33:58.822Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48829", "state": "PUBLISHED", "dateUpdated": "2026-05-26T15:21:29.987Z", "dateReserved": "2026-05-24T02:22:03.024Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-05-24T02:22:04.403Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}