CVE-2026-107161

Published 7 October 2026 · tracked since 8 October 2026

Description

A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters)

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-76266 HIGH 7.7
• CVE-2026-1403 MEDIUM 6.5
• CVE-2026-107229 MEDIUM 4
• CVE-2026-107353 MEDIUM 6.5
• CVE-2026-107313 MEDIUM 4.2
• CVE-2026-103371
• CVE-2026-107215 HIGH 7.5
• CVE-2026-107211
• CVE-2026-95606 CRITICAL 9.8
• CVE-2026-95534 HIGH 8.8

→ Open the live CVE board · all tools