# CVE-2026-86219: libauthen-sasl-perl: Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverifie...

CVE-2026-86219 is fixed in 2 products on 1 platform, first by libauthen-sasl-perl 2.2000-1ubuntu0.1, released September 6, 2026. It is not reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/cve/CVE-2026-86219
- Priority: Urgent
- CVSS: 9.8 (critical)
- EPSS: 0.0047
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 6, 2026

## Description

Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step.  server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. server_step derives the expected digest from the client's own parameters, so a response verifies whenever its digest matches the nonce it carries. The count table it also checks is keyed on the client-supplied nonce and starts empty in each new server object, so a captured first response, carrying `nc=00000001`, passes that too. RFC 2831 defines the nonce in the response as the value the server sent in the preceding challenge.  An attacker who observes one successful `qop=auth` exchange can replay the captured response against a later session for the same service, host, realm and user, and authenticate as that user without knowing the password.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libauthen-sasl-perl Debian 14 | 2.2000-2 | [DEBIAN-CVE-2026-86219](https://patchblox.com/security/data/fix/linux/debian-cve-2026-86219.md) | Sep 12, 2026 |
| Linux | libauthen-sasl-perl Ubuntu 18.04.6 LTS (bionic) | 2.1600-1ubuntu0.18.04.1~esm1 | [libauthen-sasl-perl 2.1600-1ubuntu0.18.04.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libauthen-sasl-perl-2.1600-1ubuntu0.18.04.1-esm1.md) | Oct 1, 2026 |
| Linux | libauthen-sasl-perl Ubuntu 20.04 LTS (focal) | 2.1600-1ubuntu0.20.04.1~esm1 | [libauthen-sasl-perl 2.1600-1ubuntu0.20.04.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libauthen-sasl-perl-2.1600-1ubuntu0.20.04.1-esm1.md) | Oct 1, 2026 |
| Linux | libauthen-sasl-perl Ubuntu 22.04.1 LTS (jammy) | 2.1600-1.1ubuntu0.1 | [libauthen-sasl-perl 2.1600-1.1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libauthen-sasl-perl-2.1600-1.1ubuntu0.1.md) | Oct 1, 2026 |
| Linux | libauthen-sasl-perl Ubuntu 24.04.5 LTS (noble) | 2.1700-1ubuntu0.1 | [libauthen-sasl-perl 2.1700-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libauthen-sasl-perl-2.1700-1ubuntu0.1.md) | Oct 1, 2026 |
| Linux | libauthen-sasl-perl Ubuntu 26.04.1 LTS (resolute) | 2.2000-1ubuntu0.1 | [libauthen-sasl-perl 2.2000-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libauthen-sasl-perl-2.2000-1ubuntu0.1.md) | Sep 6, 2026 |
| Linux | perl-Authen-SASL amzn 2023 | 2.16-23.amzn2023.0.4 | [ALAS2023-2026-3090](https://patchblox.com/security/data/fix/linux/alas2023-2026-3090.md) | Sep 28, 2026 |
| Linux | perl-Authen-SASL opensuse-leap 16.0 | 2.170.0-160000.4.1 | [OPENSUSE-SU-2026:21946-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21946-1.md) | Sep 24, 2026 |
| Linux | perl-Authen-SASL sles 15.6 | 2.16-150000.1.9.1 | [SUSE-SU-2026:4302-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4302-1.md) | Sep 23, 2026 |
| Linux | perl-Authen-SASL sles 15.7 | 2.16-150000.1.9.1 | [SUSE-SU-2026:4302-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4302-1.md) | Sep 23, 2026 |
| Linux | perl-Authen-SASL sles 16.0 | 2.170.0-160000.4.1 | [SUSE-SU-2026:23913-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23913-1.md) | Sep 24, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.