In versions of GNU SASL older than 2.2.3, the DIGEST-MD5 authentication routine performs a NULL pointer dereference when it receives a token that does not include the required '=' character. This flaw results in a crash of either the client or the server component, which can be exploited to disrupt service availability.

The vulnerability affects the GNU SASL library (GNU:GNU SASL) in all versions prior to 2.2.3. Both client and server implementations that use the lib/digest-md5 module can be impacted.

The CVSS score of 7.5 indicates high severity, while the absence of an EPSS score and lack of listing in CISA KEV suggest current exploitation risk is moderate but not yet observed. A likely attack vector is a network‑based attacker sending a specially crafted DIGEST‑MD5 request lacking the '=' character to a server or client that processes SASL authentication. This can lead to a denial of service through a crash, as the flaw is a direct NULL pointer dereference.