CVE-2019-19906
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet.
Published Dec 19, 2019 · updated Oct 14, 2026 · cyrusimap cyrus-sasl
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.
Timeline
Detection, updates, and resolution for this record.
Dec 19, 2019 · NIST NVD
Detected
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.
Oct 14, 2026 · NIST NVD
Updated
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.
Affected
- cpe apache/bookkeeper4.12.1
- cpe apple/ipados13.6
- cpe canonical/ubuntu linux12.04
- cpe canonical/ubuntu linux14.04
- cpe canonical/ubuntu linux16.04
- cpe canonical/ubuntu linux18.04
- cpe cyrusimap/cyrus-saslversion unspecified
- cpe debian/debian linux10.0
- cpe debian/debian linux8.0
- cpe debian/debian linux9.0
- cpe fedoraproject/fedora31
- cpe redhat/jboss enterprise web server2.0.0
Sources
- CVE.orgCVE-2019-19906
Official CVE identifier
cve.org - NIST NVDCVE-2019-19906
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.
nvd.nist.gov