I created a PR which pulls in a Red Hat downstream patch to improve thread safety in lib/client.c. I left in the original author and date (2014!). This missing patch was noticed in issue https://github.com/cyrusimap/cyrus-sasl/issues/715
regards
rob