Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain valid Kerberos ticket in realm
  2. Delivery
    Complete GSSAPI SASL bind with SSF>0
  3. Exploit
    Send oversized crafted UNBIND packet
  4. Execution
    Overflow 512-byte heap buffer in sasl_io_recv()
  5. Impact
    Crash dirsrv process (directory DoS)

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires a successfully established SASL bind that negotiates a security layer with SSF greater than 0 (integrity or confidentiality protection, typically via GSSAPI/Kerberos) - the vulnerable sasl_io_recv() path is only reached for SASL-wrapped connections, so plaintext or non-integrity binds do not trigger it. The attacker must be authenticated (PR:L): in FreeIPA / Red Hat Identity Management this means any domain user holding a valid Kerberos ticket, any enrolled host, or any service account. The trigger is a specifically crafted oversized LDAP UNBIND packet (up to ~2 MB) exceeding the 512-byte buffer. Limiting factors that reduce real-world risk: valid realm credentials are mandatory (no anonymous/unauthenticated path), the SASL integrity layer must be active, and the confirmed impact is a crash/DoS rather than proven code execution. The affected code is present in 389-ds-base from ~1.3.2 (2013) onward across RHEL 6-10 and Red Hat Directory Server 11-13.
Impact

Signals are moderately consistent but contain one important discrepancy. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) rates full confidentiality, integrity, and availability loss, yet the description characterizes the outcome strictly as a denial of service (server crash) with no claim of code execution or data disclosure - CVSS indicates high C/I/A impact but the description implies availability-only impact, so the true severity is more consistent with a DoS-grade issue (my independent assessment lowers C/I to N). Attack complexity is low and the vector is network-reachable, but PR:L confirms authentication is required, which meaningfully caps exposure to insiders or any principal that can obtain a Kerberos ticket in an IdM realm. No EPSS score, KEV entry, POC, or SSVC decision data was provided; there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a credible, easy-to-trigger crash risk for authenticated principals in Red Hat IdM/FreeIPA environments, but likely not a mass-exploitation, high-EPSS candidate given the auth and SASL-integrity prerequisites.
Exploit ScenarioDerived

A low-privileged domain user in a Red Hat IdM realm obtains a normal Kerberos ticket, opens an LDAP connection to the directory server, and completes a GSSAPI SASL bind that negotiates an integrity layer (SSF > 0). They then send a single crafted, oversized UNBIND packet whose payload overflows the 512-byte heap buffer in sasl_io_recv(), crashing the dirsrv process and taking down directory-backed authentication for the domain. No public exploit is identified at time of analysis, and low attack complexity (AC:L) means the crafted packet is the only technical hurdle once authenticated.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 07, 2026

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LDAP client to crash the server by sending an oversized UNBIND packet over a SASL integrity-protected connection. The oversized data overflows a fixed 512-byte heap receive buffer in sasl_io_recv() (sasl_io.c), and in FreeIPA / Red Hat IdM any domain user, enrolled host, or service account with a valid Kerberos ticket can trigger it after GSSAPI authentication. There is no public exploit identified at time of analysis, and this flaw is distinct from the earlier CVE-2025-14905 schema.c overflow, which did not fix this code path.

RemediationAI

No vendor-released patch version was identified at time of analysis; monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-11610 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2484414 for the fixed 389-ds-base / Red Hat Directory Server package builds and apply them via the standard errata channel as soon as they publish, then restart the dirsrv instance. Because CVE-2025-14905's fix did not touch sasl_io.c, do not assume prior updates remediate this issue. As compensating controls until a patch is available: restrict which principals can bind by tightening Kerberos/GSSAPI access and pruning unnecessary service accounts and host enrollments (trade-off: reduces the pool of potential triggers but does not eliminate insider risk); place the LDAP/LDAPS ports (389/636 and IdM equivalents) behind network segmentation and firewall rules so only trusted management hosts can reach the directory (trade-off: may break legitimate clients that connect directly); and monitor for repeated dirsrv crashes/restarts and configure automatic service recovery (e.g. systemd Restart) to limit outage duration (trade-off: recovery masks but does not prevent the DoS). Disabling SASL security layers is not a practical mitigation in Kerberos-based IdM since GSSAPI integrity is core to normal operation.

Affected VersionsENISA

Red Hat Directory Server 11.5 E4S for RHEL 8 patch: 8060020260702180044.0ca98e7e
Red Hat Directory Server 11.7 E4S for RHEL 8 patch: 8080020260702180836.f969626e
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions patch: 0:2.4.5-26.el9_4
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions patch: 8080020260630025241.6dbb3803
Red Hat Enterprise Linux 8.8 Telecommunications Update Service patch: 8080020260630025241.6dbb3803

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

389 Directory Server is Red Hat's open-source LDAP directory service and the storage/authentication backend for FreeIPA and Red Hat Identity Management. When a client negotiates a SASL bind with a security layer providing integrity or confidentiality (SSF > 0, e.g. via GSSAPI/Kerberos), inbound LDAP PDUs pass through the server's SASL I/O layer in sasl_io.c, which decodes and buffers received data before higher-level LDAP processing. The defect is a CWE-122 heap-based buffer overflow: sasl_io_recv() copies attacker-supplied packet data into a statically sized 512-byte heap buffer without validating the declared/actual length, so a crafted UNBIND PDU carrying up to roughly 2 MB of data writes far past the allocation. CPE data confirms the affected footprint spans Red Hat Directory Server 11, 12, and 13 and the 389-ds-base packages shipped with Red Hat Enterprise Linux 6 through 10.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 6.5 MEDIUM

Authenticated network attacker (PR:L, AV:N, AC:L); description confirms only a server crash with no proven disclosure or code execution, so C:N/I:N/A:H rather than the input's C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.

Executive ViewAI

Why It Matters

Red Hat 389 Directory Server (389-ds-base), a foundational authentication and identity management component deployed across enterprises, contains a denial-of-service vulnerability since version 1.3.2 (2013) that allows any authenticated domain user, service account, or enrolled host to crash the directory service remotely. Attackers can exploit this through LDAP UNBIND packets on SASL-protected connections, directly disrupting authentication infrastructure and user access organization-wide. With no vendor-released patch identified at time of analysis, this vulnerability requires immediate interim controls to protect identity and access infrastructure.

Business Impact: High
Compensating Controls

Restrict LDAP network access via firewall rules to known client IP ranges; implement connection rate limiting and per-client session limits on directory servers; deploy network-based detection for oversized UNBIND packets; maintain synchronized replica servers configured for rapid failover; minimize distribution of Kerberos service accounts and domain credentials; monitor directory server logs for connection anomalies and UNBIND errors; establish service restart procedures and on-call escalation for availability incidents; segment IdM infrastructure from untrusted networks.

Threat Intelligence Overview

EPSS Score
0.5%
Top 58% exploitable
Prevalence
High
LDAP backend for FreeIPA/Red Hat IdM across RHEL 6-10 enterprise fleets
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.5%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

45
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-107935 CRITICAL
9.3 Oct 09

Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-11610 ADVISORY https://vuldb.com/vuln/376758 REF https://access.redhat.com/errata/RHSA-2026:36195 REF https://access.redhat.com/errata/RHSA-2026:36196 REF https://access.redhat.com/errata/RHSA-2026:36197 REF https://access.redhat.com/errata/RHSA-2026:36198 REF https://access.redhat.com/errata/RHSA-2026:36200 REF https://access.redhat.com/errata/RHSA-2026:36201 REF https://access.redhat.com/errata/RHSA-2026:36202 REF https://access.redhat.com/errata/RHSA-2026:36204 REF https://access.redhat.com/errata/RHSA-2026:36205 REF https://access.redhat.com/errata/RHSA-2026:36206 REF https://access.redhat.com/errata/RHSA-2026:36208 REF https://access.redhat.com/errata/RHSA-2026:36209 REF https://access.redhat.com/errata/RHSA-2026:36585 REF https://access.redhat.com/errata/RHSA-2026:36641 REF https://access.redhat.com/errata/RHSA-2026:36660 REF https://access.redhat.com/errata/RHSA-2026:36670 REF https://access.redhat.com/errata/RHSA-2026:36671 REF https://access.redhat.com/security/cve/CVE-2026-11610 REF https://bugzilla.redhat.com/show_bug.cgi?id=2484414

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy