EUVD-2026-35424
GHSA-3mr2-rf49-p7w4
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
Primary rating from Vendor (redhat) · only source for this CVE.
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A heap buffer overflow flaw was found in 389 Directory Server. When audit logging is enabled, the create_masked_entry_string() function in auditlog.c copies a fixed-length password mask into a precisely-sized heap buffer without checking available space. If a short cleartext password is logged (requiring non-default CLEAR password storage or a compromised replication peer), the copy overflows the buffer, corrupting heap memory and audit log output.
AnalysisAI
Heap buffer overflow in Red Hat Directory Server's audit logging subsystem allows an authenticated high-privilege attacker to corrupt heap memory and tamper with audit log output. The vulnerable function create_masked_entry_string() in auditlog.c writes a fixed-length password mask into a precisely-sized heap buffer without bounds checking, overflowing when a short cleartext password is processed. Exploitation requires two non-default preconditions - audit logging must be enabled AND either CLEAR password storage must be configured or a replication peer must already be compromised - limiting real-world exposure significantly. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability is a CWE-122 (Heap-based Buffer Overflow) in the 389 Directory Server codebase, which underpins Red Hat Directory Server 11, 12, and 13. The affected code path is create_masked_entry_string() in auditlog.c, responsible for generating masked representations of password fields in audit log entries. The function allocates a heap buffer sized precisely for the password mask but performs an unchecked copy operation - when the cleartext password being logged is shorter than anticipated, the fixed-length mask overflows the allocation boundary. The overflow is only reachable when audit logging is active (nsslapd-auditlog-logging-enabled: on) and the password storage scheme is set to CLEAR (non-default; standard deployments use hashed schemes such as PBKDF2-SHA512). Alternatively, a compromised replication peer could inject a cleartext password via replication, triggering the same code path without direct CLEAR storage configuration. CPE-confirmed affected products span cpe:2.3:a:red_hat:red_hat_directory_server_11 through _13 and all Red Hat Enterprise Linux versions 6 through 10 that ship 389-ds.
RemediationAI
Apply Red Hat errata RHBA-2025:15534 (https://access.redhat.com/errata/RHBA-2025:15534), which addresses this heap overflow in the audit logging path. An exact fixed package version was not independently confirmed from the available input data - consult the errata page directly for the precise RPM version. As an immediate compensating control for systems that cannot be patched promptly, disable audit logging by setting nsslapd-auditlog-logging-enabled to off in the Directory Server configuration; note that this trade-off eliminates audit trail visibility, which may conflict with compliance requirements. Separately, verify that password storage scheme is not set to CLEAR (nsslapd-rootpwstoragescheme and nsslapd-pwdstoragescheme should use hashed schemes); if CLEAR storage was ever configured for testing, rotate it to a hashed scheme immediately. Replication topology should be reviewed to ensure all replication peers are trusted and integrity-checked, as a compromised peer represents the second trigger path. Track the Bugzilla issue at https://bugzilla.redhat.com/show_bug.cgi?id=2484915 for patch status updates.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today