Skip to main content

389 Directory Server CVE-2026-11610

| EUVDEUVD-2026-42026 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-07-07 redhat GHSA-2g8g-f92j-g4gq
Heap Overflow Denial Of Service Buffer Overflow Red Hat Red Hat Directory Server 11 Red Hat Directory Server 12 Red Hat Directory Server 13 Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Suse
8.8
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.5 MEDIUM

Authenticated network attacker (PR:L, AV:N, AC:L); description confirms only a server crash with no proven disclosure or code execution, so C:N/I:N/A:H rather than the input's C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 07, 2026 - 10:34 vuln.today
CVE Published
Jul 07, 2026 - 09:17 nvd
HIGH 8.8

DescriptionCVE.org

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.

AnalysisAI

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LDAP client to crash the server by sending an oversized UNBIND packet over a SASL integrity-protected connection. The oversized data overflows a fixed 512-byte heap receive buffer in sasl_io_recv() (sasl_io.c), and in FreeIPA / Red Hat IdM any domain user, enrolled host, or service account with a valid Kerberos ticket can trigger it after GSSAPI authentication. There is no public exploit identified at time of analysis, and this flaw is distinct from the earlier CVE-2025-14905 schema.c overflow, which did not fix this code path.

Technical ContextAI

389 Directory Server is Red Hat's open-source LDAP directory service and the storage/authentication backend for FreeIPA and Red Hat Identity Management. When a client negotiates a SASL bind with a security layer providing integrity or confidentiality (SSF > 0, e.g. via GSSAPI/Kerberos), inbound LDAP PDUs pass through the server's SASL I/O layer in sasl_io.c, which decodes and buffers received data before higher-level LDAP processing. The defect is a CWE-122 heap-based buffer overflow: sasl_io_recv() copies attacker-supplied packet data into a statically sized 512-byte heap buffer without validating the declared/actual length, so a crafted UNBIND PDU carrying up to roughly 2 MB of data writes far past the allocation. CPE data confirms the affected footprint spans Red Hat Directory Server 11, 12, and 13 and the 389-ds-base packages shipped with Red Hat Enterprise Linux 6 through 10.

RemediationAI

No vendor-released patch version was identified at time of analysis; monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-11610 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2484414 for the fixed 389-ds-base / Red Hat Directory Server package builds and apply them via the standard errata channel as soon as they publish, then restart the dirsrv instance. Because CVE-2025-14905's fix did not touch sasl_io.c, do not assume prior updates remediate this issue. As compensating controls until a patch is available: restrict which principals can bind by tightening Kerberos/GSSAPI access and pruning unnecessary service accounts and host enrollments (trade-off: reduces the pool of potential triggers but does not eliminate insider risk); place the LDAP/LDAPS ports (389/636 and IdM equivalents) behind network segmentation and firewall rules so only trusted management hosts can reach the directory (trade-off: may break legitimate clients that connect directly); and monitor for repeated dirsrv crashes/restarts and configure automatic service recovery (e.g. systemd Restart) to limit outage duration (trade-off: recovery masks but does not prevent the DoS). Disabling SASL security layers is not a practical mitigation in Kerberos-based IdM since GSSAPI integrity is core to normal operation.

More in Red Hat Directory Server 11

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-11774 HIGH
7.6 Jun 11

Heap buffer overflow in 389 Directory Server (389-ds-base) SASL I/O layer allows authenticated remote attackers to crash
CVE-2026-15722 HIGH
7.5 Jul 31

Remote unauthenticated denial of service in 389 Directory Server (389-ds-base, shipped as Red Hat Directory Server 11-13
CVE-2026-11770 HIGH
7.5 Jul 31

Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) le
CVE-2026-11788 HIGH
7.5 Jun 09

Remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13 and Red Hat Enterprise Linux 6 throu
CVE-2026-19404 MEDIUM
6.5 Aug 10

Missing authorization on CleanAllRUV and Abort CleanAllRUV LDAP extended operations in 389 Directory Server (Red Hat Dir
CVE-2026-78701 MEDIUM
6.5 Aug 25

Resource exhaustion via crafted SASL UNBIND in 389 Directory Server (389-ds-base) allows a remote authenticated attacker
CVE-2026-11789 MEDIUM
6.5 Jun 09

Denial-of-service in Red Hat's 389 Directory Server allows a highly privileged network attacker to crash the LDAP servic
CVE-2026-11884 MEDIUM
6.5 Jun 10

Heap buffer overflow in Red Hat 389 Directory Server allows an authenticated Directory Manager or a compromised replicat
CVE-2026-11611 MEDIUM
6.5 Jun 08

Denial of service in Red Hat 389 Directory Server's Content Synchronization persistent search plugin enables authenticat
CVE-2026-11786 MEDIUM
6.5 Jun 09

Out-of-bounds read in 389 Directory Server's LDIF parser exposes limited heap memory to a highly privileged local attack
CVE-2026-11787 MEDIUM
6.3 Jun 09

Heap buffer over-read in Red Hat Directory Server's ldap_utf8prev() function exposes LDAP deployments to potential confi

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8
CVE-2025-24993 HIGH
7.8
CVE-2024-30085 HIGH POC
7.8

Same technique Heap Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-5419 HIGH POC
8.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8
CVE-2024-30085 HIGH POC
7.8
CVE-2023-6246 HIGH POC
8.4

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected

Share

CVE-2026-11610 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy