CVE-2026-56968 Information disclosure in GNU SASL
A crafted server can trigger memory disclosure in the GNU SASL NTLM client due to lack of sanitization, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56968?
CVE-2026-56968 is a low-severity vulnerability in Debian Debian Linux, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.
Which versions are affected by CVE-2026-56968?
It affects 2 products.
Linux distribution packages (3)
gsasl SUSE:Linux Enterprise Server 16.0 | All versions | 2.2.1-160000.4.1 |
gsasl SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 2.2.1-160000.4.1 |
gsasl openSUSE:Leap 16.0 | All versions | 2.2.1-160000.4.1 |
Products include Debian Debian Linux, Gnu Sasl.
How do I fix CVE-2026-56968?
Upgrade to a fixed version.
Is CVE-2026-56968 being exploited?
There is no known exploitation of CVE-2026-56968 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2026-56968, GHSA-2qgp-6c6g-cmwv, SUSE-SU-2026:22631-1, UBUNTU-CVE-2026-56968, openSUSE-SU-2026:21303-1.