Unpatched vulnerabilities in Cyrus SASL and no new release since 2022

What happened and what to do

According to the post by Alan Coopersmith on the oss-sec list, dated 9 October 2026, several publicly disclosed security problems in the Cyrus SASL project remain unanswered by maintainers. Former maintainers say they are no longer involved. The project has had no new release since 2022, and the only commits in the last year were documentation updates recording cyrus-imapd releases. Listed open items include memory leaks in _sasl_make_plain_secret and other issues still open.

For a company that uses Cyrus SASL for authentication in mail servers or internal services, the risk is depending on a library without active maintenance. A practical first step is to inventory where the library is embedded, including third-party packages and container images, and to monitor advisories and commits so you know when a fix appears. In parallel, you can build an exposure dashboard per service, define compensating controls such as network isolation and access restriction, and plan a migration or a controlled fork validated by authentication regression tests.

How the consultancy can help

Diagnosis of Cyrus SASL exposure: usage inventory across servers, containers and packages, risk classification and compensating controls. Then implementation of advisory and version monitoring, with an exposure dashboard and a scoped migration plan.

Next step

If your company depends on Cyrus SASL, send a short description of your environment and case. We will reply with a scoped diagnosis and implementation proposal.