GNU Sasl vulnerabilities

2 CVEs affecting GNU Sasl, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-48829, published 2026-05-24.

More from GNU.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-2469, published 2022-07-19. High severity, CVSS 8.1. EPSS: 1.6% chance of exploitation in the next 30 days. GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client
• CVE-2026-48829, published 2026-05-24. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.