Hi,

The following vulnerability was published for cyrus-sasl2.

CVE-2026-107161[0]:
| A heap-based buffer overflow flaw was found in Cyrus SASL. The
| add_to_challenge() function in the DIGEST-MD5 plugin computes the
| size of the buffer needed for a challenge/response field before
| DIGEST-MD5 quoting is applied, but does not recompute that size when
| quoting (escaping special characters) makes the value longer. The
| under-sized buffer is then passed to strcat(), causing a heap-based
| out-of-bounds write whose size depends on attacker-controlled input.
| A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can
| trigger this flaw in a connecting client by supplying a crafted
| challenge field, such as realm or nonce, most likely resulting in a
| crash of the client application.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-107161
https://www.cve.org/CVERecord?id=CVE-2026-107161
[1] https://github.com/cyrusimap/cyrus-sasl/issues/889
[2] https://github.com/cyrusimap/cyrus-sasl/pull/892
[3] https://bugzilla.redhat.com/show_bug.cgi?id=2460420

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
cyrus-sasl2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150516@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bastian Germann <bage@debian.org> (supplier of updated cyrus-sasl2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 16 Oct 2026 23:04:01 +0200
Source: cyrus-sasl2
Architecture: source
Version: 2.1.28+dfsg1-12
Distribution: unstable
Urgency: medium
Maintainer: Debian Cyrus Team <team+cyrus@tracker.debian.org>
Changed-By: Bastian Germann <bage@debian.org>
Closes: 1150516
Changes:
 cyrus-sasl2 (2.1.28+dfsg1-12) unstable; urgency=medium
 .
   * Team upload
   * Add CVE-2026-107161 regression test
   * Add the CVE-2026-107161 report's suggested fix (Closes: #1150516)
 .
   [ Peter Wienemann ]
   * Add RuntimeDirectoryMode=0710 to d/sasl2-bin.saslauthd.service
Checksums-Sha1:
 6ec0729fecd57ed8146e620ed1ec08b8bbdf43aa 3484 cyrus-sasl2_2.1.28+dfsg1-12.dsc
 735f3bfc228c371068e838f6182c5caba0e734eb 104996 cyrus-sasl2_2.1.28+dfsg1-12.debian.tar.xz
 a66a237084af3315ad6bb944736dd2cc4d37ee1f 5518 cyrus-sasl2_2.1.28+dfsg1-12_source.buildinfo
Checksums-Sha256:
 caf1da13a075f72af055d3f2c658bec5d9e484202cb0e7c85755e7b6cdc9eb7d 3484 cyrus-sasl2_2.1.28+dfsg1-12.dsc
 5aef55aa41fad421aed3fa1cf1f79ecb9db82534220c6211d64383ae5f39e20f 104996 cyrus-sasl2_2.1.28+dfsg1-12.debian.tar.xz
 c34e17ae56b6526751085f8cb1cae46469b8dd213b2fbc7cbdb5a1869cb9ab87 5518 cyrus-sasl2_2.1.28+dfsg1-12_source.buildinfo
Files:
 db70385b37709a79bb905dd324a2c678 3484 libs optional cyrus-sasl2_2.1.28+dfsg1-12.dsc
 ea2b1fa8dbf56f219274705b2e83f8f2 104996 libs optional cyrus-sasl2_2.1.28+dfsg1-12.debian.tar.xz
 06abc45ca77d946a6848aea76321fc66 5518 libs optional cyrus-sasl2_2.1.28+dfsg1-12_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQHEBAEBCgAuFiEEQGIgyLhVKAI3jM5BH1x6i0VWQxQFAmrSkZIQHGJhZ2VAZGVi
aWFuLm9yZwAKCRAfXHqLRVZDFJWKDADeXApFa4cpKcv7vEFZncWZuA1gZru9eto8
BFyVK0n2a7ZJLkQ8sZq3KngDYLbF2/sPxnzLfFggmrVcKZsMC2lDHwFx/J9PGYdR
goGgovXWDeBBYy/NMubqo8c+i28prw39qpKsjn5i81OAwkTU7qEzeb0WPXL+grmJ
FnchxVe6NhQGPMFbO6WIKNbaB8JUqJejpR4+tWk0gbsKmdDs01laOZ6E2kUam0/2
ZctXjB1YJSUmEXFdfxonPiplLRawSsb4eGLPoy334/chRdynzTHedj9RaRvUlmUo
bvWkHDcsLpmtwtYb+eXvJKLbc7MgTzBIpYwQQJEyoQLG3iKf9NXdz4NKgwTuOUaX
4qzrRxRwp1OT3bQYErzTm3rVqtcQul3f8rf3RVRwQscZMWejncl40/mCp8gPqU9Z
c1yGQqwZ8wjuC2Hd4MY+Y9GuoxDOsArwpEjrth3644GRWAbKxmUVKWkNloWpge6r
ykdagfSIvCtkJKTw3bzP2Pk675MpBSk=
=tVgz
-----END PGP SIGNATURE-----