| Package | cyrus-sasl2 |
|---|---|
| Version | 2.1.27~101-g0780600+dfsg-3+deb9u3 (stretch), 2.1.27+dfsg-1+deb10u3 (buster), 2.1.27+dfsg-2.1+deb11u2 (bullseye) |
| Related CVEs | CVE-2026-107161 |
An issue has been found in cyrus-sasl2, a SASL (Simple Authentication and Security Layer) implementation for the Cyrus mail system. The issue is related to a heap-based buffer overflow due to not recomputing a buffer size in the DIGEST-MD5 plugin.
For Debian 10 buster, these problems have been fixed in version 2.1.27+dfsg-1+deb10u3.
For Debian 11 bullseye, these problems have been fixed in version 2.1.27+dfsg-2.1+deb11u2.
For Debian 9 stretch, these problems have been fixed in version 2.1.27~101-g0780600+dfsg-3+deb9u3.
We recommend that you upgrade your cyrus-sasl2 packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.