CVE-2009-0688: Carnegie Mellon University Cyrus-Sasl

High severity, CVSS 7.5. EPSS: 8.2% chance of exploitation in the next 30 days.

Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.

Affected products

• Carnegie Mellon University Cyrus-Sasl: up to and including 2.1.22; version 1.4.1 only; version 1.5.0 only; version 1.5.2 only; version 1.5.3 only; version 1.5.5 only; …

Published 2009-05-15. Last modified 2026-06-16.