low3.7
CVE-2026-56968
GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a craf…
Impact
GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gnu | Sasl | before 2.2.4 |
| Debian | Debian Linux | Version 13.0 |