Skip to content
OpenAdvisories
Critical USN-8858-1 1 CVE

libauthen-sasl-perl vulnerability

Published Sep 30, 2026 · Updated Oct 1, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Authen::SASL, a Perl authentication library, did
not properly validate login attempts. An attacker could possibly use
this issue to gain unauthorized access.

Fixed packages 7

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS libauthen-sasl-perl 2.1600-1.1ubuntu0.1
Ubuntu · 24.04 LTS 24.04:LTS libauthen-sasl-perl 2.1700-1ubuntu0.1
Ubuntu · 26.04 LTS 26.04:LTS libauthen-sasl-perl 2.2000-1ubuntu0.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS libauthen-sasl-perl 2.1500-1ubuntu0.1~esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS libauthen-sasl-perl 2.1600-1ubuntu0.16.04.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS libauthen-sasl-perl 2.1600-1ubuntu0.18.04.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS libauthen-sasl-perl 2.1600-1ubuntu0.20.04.1~esm1

Vulnerabilities 1

  • Critical 9.8
    CVE-2026-86219

    Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step

    Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step. server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the …

    libauthen-sasl-perl libauthen-sasl-perl Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2026-86219