--- id: CVE-2019-19906 title: >- cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet summary: >- cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-193 - CWE-787 - CWE-400 vendor: cyrusimap product: cyrus-sasl affected: - cyrus-sasl < 2.1.28 - debian_linux = 8.0 - debian_linux = 9.0 - debian_linux = 10.0 - ubuntu_linux = 12.04 - ubuntu_linux = 14.04 - ubuntu_linux = 16.04 - ubuntu_linux = 18.04 - ubuntu_linux = 19.10 - fedora = 31 - fedora = 32 - jboss_enterprise_web_server = 2.0.0 - mac_os_x = 10.14.6 - enterprise_linux = 5.0 - enterprise_linux = 6.0 - enterprise_linux = 7.0 - enterprise_linux = 8.0 - enterprise_linux_eus = 8.4 - enterprise_linux_for_ibm_z_systems = 8.0 - enterprise_linux_for_ibm_z_systems_eus = 8.4 - enterprise_linux_for_power_little_endian = 8.0 - enterprise_linux_for_power_little_endian_eus = 8.4 - enterprise_linux_server_aus = 8.4 - >- enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 8.4 - enterprise_linux_server_tus = 8.4 - enterprise_linux_server_update_services_for_sap_solutions = 8.4 - ipados = 13.6 - iphone_os = 13.6 - mac_os_x < 10.13.6 - 'mac_os_x >= 10.13.0, < 10.13.6' - 'mac_os_x >= 10.15.0, < 10.15.6' - mac_os_x = 10.13.6 - bookkeeper = 4.12.1 patched: - cyrus-sasl 2.1.28 - mac_os_x 10.15.6 published: '2019-12-19' updated: '2026-10-14' sourceUpdated: '2026-10-14T08:16:59.200' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-19906' references: - url: 'http://seclists.org/fulldisclosure/2020/Jul/23' label: cve@mitre.org - url: 'http://seclists.org/fulldisclosure/2020/Jul/24' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2022/02/23/4' label: cve@mitre.org - url: 'https://github.com/cyrusimap/cyrus-sasl/issues/587' label: cve@mitre.org - url: >- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E label: cve@mitre.org - url: >- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html' label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/ label: cve@mitre.org - url: 'https://seclists.org/bugtraq/2019/Dec/42' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT211288' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT211289' label: cve@mitre.org - url: 'https://usn.ubuntu.com/4256-1/' label: cve@mitre.org - url: 'https://www.debian.org/security/2019/dsa-4591' label: cve@mitre.org - url: 'https://www.openldap.org/its/index.cgi/Incoming?id=9123' label: cve@mitre.org - url: 'http://seclists.org/fulldisclosure/2020/Jul/23' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://seclists.org/fulldisclosure/2020/Jul/24' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2022/02/23/4' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/cyrusimap/cyrus-sasl/issues/587' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://seclists.org/bugtraq/2019/Dec/42' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT211288' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT211289' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4256-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2019/dsa-4591' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.openldap.org/its/index.cgi/Incoming?id=9123' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-19906.json - url: 'https://access.redhat.com/security/cve/CVE-2019-19906' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1791854' - url: 'https://www.cve.org/CVERecord?id=CVE-2019-19906' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-19906' - url: 'https://access.redhat.com/errata/RHSA-2020:4497' tags: - nvd - csaf - vex - red-hat epss: 0.08036 epssPercentile: 0.94676 ingestedAt: '2026-10-14T08:23:04.326Z' --- ## Overview cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl. ## Affected - `cyrus-sasl < 2.1.28` - `debian_linux = 8.0` - `debian_linux = 9.0` - `debian_linux = 10.0` - `ubuntu_linux = 12.04` - `ubuntu_linux = 14.04` - `ubuntu_linux = 16.04` - `ubuntu_linux = 18.04` - `ubuntu_linux = 19.10` - `fedora = 31` - `fedora = 32` - `jboss_enterprise_web_server = 2.0.0` - `mac_os_x = 10.14.6` - `enterprise_linux = 5.0` - `enterprise_linux = 6.0` - `enterprise_linux = 7.0` - `enterprise_linux = 8.0` - `enterprise_linux_eus = 8.4` - `enterprise_linux_for_ibm_z_systems = 8.0` - `enterprise_linux_for_ibm_z_systems_eus = 8.4` - `enterprise_linux_for_power_little_endian = 8.0` - `enterprise_linux_for_power_little_endian_eus = 8.4` - `enterprise_linux_server_aus = 8.4` - `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 8.4` - `enterprise_linux_server_tus = 8.4` - `enterprise_linux_server_update_services_for_sap_solutions = 8.4` - `ipados = 13.6` - `iphone_os = 13.6` - `mac_os_x < 10.13.6` - `mac_os_x >= 10.13.0, < 10.13.6` - `mac_os_x >= 10.15.0, < 10.15.6` - `mac_os_x = 10.13.6` - `bookkeeper = 4.12.1` ## Remediation Upgrade past the affected range: - `cyrus-sasl 2.1.28` - `mac_os_x 10.15.6` ## Vendor advisories - **RHSA-2020:4497** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8) · released 2020-11-04 · [advisory](https://access.redhat.com/errata/RHSA-2020:4497) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat JBoss Enterprise Web Server 2 · no fix planned: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat JBoss Enterprise Web Server 2, Red Hat Enterprise Linux 7 · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-19906.json)