CVE-2026-56968: Debian Linux

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

Affected products

• Debian Debian Linux: version 13.0 only
• GNU Sasl: before 2.2.4 (fixed in 2.2.4)

Published 2026-06-23. Last modified 2026-07-31.