Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND fix introduced state bug in that approach. The copy clamps the size, but it does not advance the buffered offset. On the next receive the server waits for another complete N bytes instead of returning the already-buffered remainder (N - len).

Example: a 562-byte UNBIND with the default 512-byte connection buffer returns 512 bytes, then waits for 562 new bytes rather than the remaining 50. A remote SASL-authenticated client can leave the socket open, so the connection stays stalled until the I/O timeout. Repeated connections could be a resource-exhaustion / DoS vector.

CVE-2026-11610 - incomplete fix may introduce a connection-stall DoS