CVE-2026-48829: GNU Sasl

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.

Affected products

• GNU GNU Sasl: before 2.2.3 (fixed in 2.2.3)

Published 2026-05-24. Last modified 2026-07-23.