EUVD-2026-35424
GHSA-3mr2-rf49-p7w4
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
Primary rating from Vendor (redhat) · only source for this CVE.
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
A heap buffer overflow flaw was found in 389 Directory Server. When audit logging is enabled, the create_masked_entry_string() function in auditlog.c copies a fixed-length password mask into a precisely-sized heap buffer without checking available space. If a short cleartext password is logged (requiring non-default CLEAR password storage or a compromised replication peer), the copy overflows the buffer, corrupting heap memory and audit log output.
AnalysisAI
Heap buffer overflow in Red Hat Directory Server's audit logging subsystem allows an authenticated high-privilege attacker to corrupt heap memory and tamper with audit log output. The vulnerable function create_masked_entry_string() in auditlog.c writes a fixed-length password mask into a precisely-sized heap buffer without bounds checking, overflowing when a short cleartext password is processed. Exploitation requires two non-default preconditions - audit logging must be enabled AND either CLEAR password storage must be configured or a replication peer must already be compromised - limiting real-world exposure significantly. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability is a CWE-122 (Heap-based Buffer Overflow) in the 389 Directory Server codebase, which underpins Red Hat Directory Server 11, 12, and 13. The affected code path is create_masked_entry_string() in auditlog.c, responsible for generating masked representations of password fields in audit log entries. The function allocates a heap buffer sized precisely for the password mask but performs an unchecked copy operation - when the cleartext password being logged is shorter than anticipated, the fixed-length mask overflows the allocation boundary. The overflow is only reachable when audit logging is active (nsslapd-auditlog-logging-enabled: on) and the password storage scheme is set to CLEAR (non-default; standard deployments use hashed schemes such as PBKDF2-SHA512). Alternatively, a compromised replication peer could inject a cleartext password via replication, triggering the same code path without direct CLEAR storage configuration. CPE-confirmed affected products span cpe:2.3:a:red_hat:red_hat_directory_server_11 through _13 and all Red Hat Enterprise Linux versions 6 through 10 that ship 389-ds.
RemediationAI
Apply Red Hat errata RHBA-2025:15534 (https://access.redhat.com/errata/RHBA-2025:15534), which addresses this heap overflow in the audit logging path. An exact fixed package version was not independently confirmed from the available input data - consult the errata page directly for the precise RPM version. As an immediate compensating control for systems that cannot be patched promptly, disable audit logging by setting nsslapd-auditlog-logging-enabled to off in the Directory Server configuration; note that this trade-off eliminates audit trail visibility, which may conflict with compliance requirements. Separately, verify that password storage scheme is not set to CLEAR (nsslapd-rootpwstoragescheme and nsslapd-pwdstoragescheme should use hashed schemes); if CLEAR storage was ever configured for testing, rotate it to a hashed scheme immediately. Replication topology should be reviewed to ensure all replication peers are trusted and integrity-checked, as a compromised peer represents the second trigger path. Track the Bugzilla issue at https://bugzilla.redhat.com/show_bug.cgi?id=2484915 for patch status updates.
More in Red Hat Directory Server 11
View allDenial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Heap buffer overflow in 389 Directory Server (389-ds-base) SASL I/O layer allows authenticated remote attackers to crash
Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) le
Remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13 and Red Hat Enterprise Linux 6 throu
Remote unauthenticated denial of service in 389 Directory Server (389-ds-base, shipped as Red Hat Directory Server 11-13
Denial-of-service in Red Hat's 389 Directory Server allows a highly privileged network attacker to crash the LDAP servic
Heap buffer overflow in Red Hat 389 Directory Server allows an authenticated Directory Manager or a compromised replicat
Denial of service in Red Hat 389 Directory Server's Content Synchronization persistent search plugin enables authenticat
Out-of-bounds read in 389 Directory Server's LDIF parser exposes limited heap memory to a highly privileged local attack
Heap buffer over-read in Red Hat Directory Server's ldap_utf8prev() function exposes LDAP deployments to potential confi
Heap buffer overflow in 389 Directory Server's ACI parsing layer allows an authenticated LDAP user with write access to
Heap-buffer-overflow in 389 Directory Server's DN normalization routine allows an unauthenticated remote attacker to cor
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today