perl-authen-sasl CVE-2025-40918

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:13 vuln.today

DescriptionCVE.org

Alpine Linux: perl-authen-sasl fixed in 2.1900

AnalysisAI

perl-authen-sasl on Alpine Linux received a security fix in version 2.1900, addressing an unspecified vulnerability in the Perl Authen::SASL module. The nature of the flaw, its root cause, and the attacker impact are not disclosed in available intelligence; the sole confirmed data point is the fix version from the Alpine Linux vendor advisory. No public exploit has been identified at time of analysis, and EPSS places this at 0.41% exploitation probability (62nd percentile), suggesting moderate relative interest but low absolute exploitation likelihood.

Technical ContextAI

Authen::SASL is a Perl CPAN module that implements the Simple Authentication and Security Layer (SASL) protocol, commonly used to authenticate connections in email clients (SMTP, IMAP), LDAP clients, and other protocol stacks requiring pluggable authentication. The package is bundled as 'perl-authen-sasl' in Alpine Linux's package management ecosystem. The affected scope is limited to the Alpine Linux distribution packaging of this module at versions prior to 2.1900. No CWE is provided, so the root cause class - whether it involves improper input validation, authentication bypass, cryptographic weakness, or another category - cannot be determined from available data. No CPE strings were provided to further constrain the affected platform scope.

Affected ProductsAI

The affected product is perl-authen-sasl as packaged in Alpine Linux at versions prior to 2.1900. The fix is confirmed at version 2.1900 per the Alpine Linux vendor report. No upstream CPAN version mapping, no CPE string, and no additional platform constraints are available from the provided intelligence. Other Linux distributions shipping Authen::SASL may or may not be affected depending on whether they track the same upstream code and whether they have independently patched the issue.

RemediationAI

Upgrade perl-authen-sasl to version 2.1900 or later on Alpine Linux systems using the standard package manager: 'apk upgrade perl-authen-sasl'. This is the only confirmed fix; no specific advisory URL was provided in the available intelligence. No workarounds or compensating controls can be responsibly recommended without knowing the vulnerability's root cause or attack vector. If upgrading is not immediately possible, consider auditing applications that depend on Authen::SASL for SASL-authenticated connections (SMTP, IMAP, LDAP) and restrict network exposure of those services as a precautionary measure, accepting the trade-off of potential service disruption.