# CVE-2026-107161: Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients

Status: published. Published: 2026-10-07. Updated: 2026-11-05.

A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.

## Remediation

- workaround: If DIGEST-MD5 authentication is not strictly required, remove the optional cyrus-sasl-md5 package to eliminate the vulnerable plugin:

# dnf remove cyrus-sasl-md5

Alternatively, configure client applications to disable DIGEST-MD5 and HTTP Digest authentication methods, prioritizing stronger mechanisms such as GSSAPI or SCRAM.

Caveat: Removing cyrus-sasl-md5 removes support for both DIGEST-MD5 and CRAM-MD5 mechanisms. Any client or server process depending on these algorithms will fail to negotiate authentication. Active services utilizing SASL may need to be restarted to unload the plugin from memory. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Enterprise Linux 10 (cyrus-sasl): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (cyrus-sasl): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (cyrus-sasl): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (cyrus-sasl): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (cyrus-sasl): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (cyrus-sasl): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-8): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 5 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H; source: CNA: redhat

- CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H; source: NVD: secalert@redhat.com

- CISA KEV: No listing in collected sources

- EPSS: 0.38% as of 2026-11-05; percentile 31.74%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-122

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/security/cve/CVE-2026-107161 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2460420 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- http://www.openwall.com/lists/oss-security/2026/10/09/20 (ADP: CVE)

- https://lists.debian.org/debian-lts-announce/2026/10/msg00064.html (ADP: CVE)

- https://access.redhat.com/security/cve/CVE-2026-107161 (secalert@redhat.com)

- https://bugzilla.redhat.com/show_bug.cgi?id=2460420 (secalert@redhat.com)

- http://www.openwall.com/lists/oss-security/2026/10/09/20 (af854a3a-2127-422b-91ae-364da2661108)

- https://lists.debian.org/debian-lts-announce/2026/10/msg00064.html (af854a3a-2127-422b-91ae-364da2661108)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-107161; retrieved 2026-11-05; source updated 2026-11-05

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-107161; retrieved 2026-11-05; source updated 2026-11-05

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-107161; retrieved 2026-11-05; source updated Not reported

Revision: e2b0beb8ba027b199efbea567e0a19ad1259de8c7549a28a49165c7b889ca507

Canonical: https://y2.dev/cve/CVE-2026-107161

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.