CVE-2026-107161 in Cyrus-SASL
Summary
by MITRE • 10/07/2026
A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in Cyrus SASL represents a critical heap-based buffer overflow within the DIGEST-MD5 authentication plugin, specifically located in the add_to_challenge function. This flaw stems from a fundamental miscalculation regarding memory allocation during the construction of challenge-response fields. The software initially computes the required size for a buffer based on the raw input data before any transformation is applied. However, it fails to account for the expansion that occurs when special characters are escaped or quoted according to DIGEST-MD5 specifications. This oversight results in the allocation of an undersized heap buffer that is insufficient to hold the final, expanded string content.
When the application proceeds to concatenate data into this inadequately sized buffer using strcat(), it triggers a heap-based out-of-bounds write operation. The extent of the memory corruption depends directly on attacker-controlled input values such as the realm or nonce fields provided by the server during the authentication handshake. Because the overflow occurs in heap memory, an adversary can potentially manipulate adjacent data structures within the same allocation zone. While immediate exploitation for arbitrary code execution may be complex due to modern memory protection mechanisms like ASLR and DEP, the primary consequence is a denial of service through application crash or segmentation fault.
From a threat modeling perspective, this vulnerability aligns with CWE-120, which classifies buffer copies without checking size limits as a classic cause of heap overflows. It also relates to CWE-675 regarding operations on data from untrusted sources without sufficient validation. In the context of the MITRE ATT&CK framework, this flaw facilitates Initial Access and potentially Execution if an attacker can leverage the memory corruption for code execution, though it is primarily observed as a Denial of Service vector in current implementations. The attack requires a malicious or compromised on-path server to supply crafted challenge fields that exploit the size miscalculation during the authentication phase.
Mitigation strategies should prioritize immediate patching by updating Cyrus SASL to versions where this logic error has been corrected, ensuring that buffer sizes are recalculated after quoting operations are applied. For environments where upgrading is not immediately feasible, network-level controls such as strict firewall rules can restrict connections to untrusted or potentially compromised authentication servers. Additionally, deploying intrusion detection systems capable of identifying anomalous SASL traffic patterns may help in detecting exploitation attempts before they result in service disruption. Regular security audits and static analysis tools should be employed to detect similar size calculation errors in other components of the authentication infrastructure.