What is GHSA-2qgp-6c6g-cmwv?

GHSA-2qgp-6c6g-cmwv is a security advisory published by GitHub Security Advisories with Low severity. GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the...

Which CVE IDs does GHSA-2qgp-6c6g-cmwv cover?

GHSA-2qgp-6c6g-cmwv covers the following CVE IDs: CVE-2026-56968. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2qgp-6c6g-cmwv?

GHSA-2qgp-6c6g-cmwv has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

GHSA-2qgp-6c6g-cmwvLowCVSS 3.7

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the...

Vendor

GitHub Security Advisories

Published

June 23, 2026

Last Modified

June 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-56968 →

📋 Description

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2026-56968
https://ftp.gnu.org/gnu/gsasl
https://lists.debian.org/debian-security-announce/2026/msg00259.html
https://lists.gnu.org/archive/html/help-gsasl/2026-06/msg00000.html
https://www.gnu.org/software/gsasl
https://github.com/advisories/GHSA-2qgp-6c6g-cmwv