PatchTheCVE: cyrus-saslhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2022-24407: In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERThttps://patchthecve.com/cve/CVE-2022-24407.htmlhttps://patchthecve.com/cve/CVE-2022-24407.htmlWed, 14 Oct 2026 16:17:27 +0000HIGH 8.8: In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.CVE-2020-8032: A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attackhttps://patchthecve.com/cve/CVE-2020-8032.htmlhttps://patchthecve.com/cve/CVE-2020-8032.htmlWed, 17 Jun 2026 03:25:49 +0000MEDIUM 6.7: A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attackers to escalate to root. This issue affects: openSUSE Factory cyrus-sasl version 2.1.27-4.2 and prior versions.CVE-2019-19906: cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-servhttps://patchthecve.com/cve/CVE-2019-19906.htmlhttps://patchthecve.com/cve/CVE-2019-19906.htmlWed, 14 Oct 2026 08:16:59 +0000HIGH 7.5: cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.CVE-2013-4122: Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error byhttps://patchthecve.com/cve/CVE-2013-4122.htmlhttps://patchthecve.com/cve/CVE-2013-4122.htmlTue, 16 Jun 2026 23:56:39 +0000MEDIUM 4.3: Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service (thread crash and consumption) via (1) an invalid salt or, when FIPS-14CVE-2009-0688: Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute https://patchthecve.com/cve/CVE-2009-0688.htmlhttps://patchthecve.com/cve/CVE-2009-0688.htmlTue, 16 Jun 2026 23:05:34 +0000HIGH 7.5: Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.