https://github.com/cyrusimap/cyrus-sasl/issues/891 points out there are a number of publicly reported security issues in the Cyrus SASL project, with no response from maintainers, other than former maintainers saying they are no longer involved; no new version since 2022, and the only commits in the past year being doc updates to note cyrus-imapd releases.
The listed open security issues are: * Memory leaks in _sasl_make_plain_secret and _sasl_auxprop_verify_apop, lib/checkpw.c #887 - https://github.com/cyrusimap/cyrus-sasl/issues/887 * [VS-CSASL-2026-0001] - 1-Byte Heap Out-of-Bounds Read in Cyrus SASL SCRAM GS2 Header Parser #888 - https://github.com/cyrusimap/cyrus-sasl/issues/888 * [Security] Heap Buffer Overflow in DIGEST-MD5 add_to_challenge()doc (plugins/digestmd5.c) and others #889 - https://github.com/cyrusimap/cyrus-sasl/issues/889 * --with-pic static build registers zero SASL mechanisms and yields a non-PIC libsasl2.a (CRAM-MD5 unavailable; won't link into a PIE) #895 - https://github.com/cyrusimap/cyrus-sasl/issues/895 * [Security] SRP server authentication bypass: A == 0 (mod N) not rejected (CWE-347) #896 - https://github.com/cyrusimap/cyrus-sasl/issues/887 Only one of these appears to have been assigned a CVE id so far - Red Hat assigned CVE-2026-107161 for https://bugzilla.redhat.com/show_bug.cgi?id=2460420 which seems to match https://github.com/cyrusimap/cyrus-sasl/issues/889 (or perhaps be an independent finding of the same issue?) -- -Alan Coopersmith- [email protected] Oracle Solaris Engineering - https://blogs.oracle.com/solaris
