CVE-2026-56968

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-06-23 · updated 2026-10-25
Weakness: CWE-839

Description

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

Affected products

Debian Linux: 13.0
GNU Sasl: before 2.2.4 — fixed in 2.2.4

How to fix

Upgrade to a fixed version: GNU Sasl 2.2.4. Check the vendor advisory for mitigations.

References

https://ftp.gnu.org/gnu/gsasl/
https://lists.debian.org/debian-security-announce/2026/msg00259.html
https://lists.gnu.org/archive/html/help-gsasl/2026-06/msg00000.html
https://www.gnu.org/software/gsasl/
https://lists.debian.org/debian-lts-announce/2026/07/msg00049.html

Get alerted when CVE-2026-56968 or the next vulnerability affects your stack