SUSE cyrus-sasl Update Resolves DIGEST

Back Linuxsecurity

SUSE cyrus-sasl Update Resolves DIGEST

Linuxsecurity •LinuxSecurity Advisories • October 21, 2026

Share: View original

Running self-managed GitLab? Critical flaws could allow server code execution. Check the fixes. ×

## This update for cyrus-sasl fixes the following issue: * CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise DIGEST-MD5 clients (bsc#1284687). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-4817 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-4817 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-4817

## This update for cyrus-sasl fixes the following issue: * CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise DIGEST-MD5 clients (bsc#1284687). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-4817 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-4817 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-4817

* CVE-2026-107161 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2026-107161 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

* SUSE Linux Enterprise High Performance Computing 15 SP5

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5

* SUSE Linux Enterprise Micro 5.5

* SUSE Linux Enterprise Server 15 SP5

* SUSE Linux Enterprise Server 15 SP5 LTSS

* SUSE Linux Enterprise Server for SAP Applications 15 SP5

An update that solves one vulnerability can now be installed.

*

*

Announcement ID: SUSE-SU-2026:4817-1 Release Date: 2026-10-21T10:12:40Z Rating: important

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SUSE cyrus-sasl Update Addresses Heap Overflow Vulnerability SUSE has released updates for cyrus-sasl to fix a heap buffer overflow vulnerability, CVE-2026-107161, affecting DIGEST-MD5 clients. This flaw allows malicious servers to crash or compromise clients, posing significant risks to systems using affected versions of SUSE Linux Enterprise Server and openSUSE. The vulnerability has a CVSS score of 7.5, indicating a high severity level. Administrators are urged to apply the patches immediately to mitigate potential exploitation. The updates are available for various SUSE Linux Enterprise versions, including 12 SP5 and 15 SP5. The vulnerability was published on October 7, 2026, and the patches were released on October 21, 2026. Users should follow the provided patch instructions to secure their systems. 6 sources 59

Extracted Entities

CVEs (1)

CVE-2026-107161

CWE Weaknesses (1)

CWE-122 - Heap-based Buffer Overflow

Platforms (5)

SUSE Linux Enterprise High Performance Computing Espos SUSE Linux Enterprise High Performance Computing LTSS SUSE Linux Enterprise Micro SUSE Linux Enterprise Server SUSE Linux Enterprise Server For SAP Applications