EUVD-2026-38512
GHSA-2qgp-6c6g-cmwv
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network vector with High complexity (MITM or malicious server required to deliver crafted NTLM challenge); no privileges needed; confidentiality-only impact from memory over-read.
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.
AnalysisAI
Memory disclosure in GNU SASL's NTLM client implementation allows a malicious or man-in-the-middle server to extract portions of client process memory by delivering a crafted undersized challenge to the _gsasl_ntlm_client_step function. All GNU SASL versions before 2.2.4 are affected, with the fix confirmed in the 2.2.4 release and a Debian security advisory issued downstream. No active exploitation has been identified; the high attack complexity required to position a malicious NTLM server tempers the already-low CVSS 3.7 rating.
Technical ContextAI
GNU SASL (gsasl) is a C library implementing the Simple Authentication and Security Layer (SASL) framework, including the NTLM mechanism used for challenge-response authentication. The affected function, _gsasl_ntlm_client_step, processes server-issued NTLM challenge tokens during the client handshake. CWE-839 (Numeric Range Comparison Without Minimum Check) pinpoints the root cause: the implementation validates that the challenge does not exceed an upper bound but omits a minimum-length check. When a server provides an undersized challenge, the client reads past the valid buffer boundary, exposing adjacent heap or stack memory contents. The affected CPE is cpe:2.3:a:gnu:gnu_sasl:*:*:*:*:*:*:*:*, covering all releases prior to 2.2.4.
RemediationAI
Upgrade GNU SASL to version 2.2.4 or later, which introduces proper minimum-length sanitization of the NTLM challenge in _gsasl_ntlm_client_step; the release is available at https://ftp.gnu.org/gnu/gsasl/. Debian users should apply the security update referenced at https://lists.debian.org/debian-security-announce/2026/msg00259.html using the standard package management workflow. If an immediate upgrade is not feasible, disable the NTLM SASL mechanism in the application's SASL mechanism list - this eliminates the vulnerable code path entirely but will break connectivity to servers that require NTLM exclusively, which is a trade-off to evaluate based on the environment. Applications that already restrict allowed SASL mechanisms to non-NTLM options (PLAIN, SCRAM, GSSAPI, etc.) are not exposed to this vulnerability regardless of the installed GNU SASL version.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today