ByteOS Network

CVE Vulnerability Details :

CVE-2026-48829

PUBLISHED

More Info Official Page

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-24 May, 2026 | 02:22

Updated At-24 May, 2026 | 02:33

▼CVE Numbering Authority (CNA)

In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.

Affected Products

Vendor

GNU

Product

GNU SASL

Default Status

unaffected

Versions

Affected

From 0 before 2.2.3 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-476	CWE-476 NULL Pointer Dereference

Type: CWE

CWE ID: CWE-476

Description: CWE-476 NULL Pointer Dereference

Metrics

Version	Base score	Base severity	Vector
3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Hyperlink	Resource
https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00002.html	N/A
https://codeberg.org/gsasl/gsasl/commit/da9b5ae2962b014879e4a406c3b38f25aa70e97a	N/A
https://lists.debian.org/debian-security-announce/2026/msg00182.html	N/A
https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00000.html	N/A