Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-11774 (GCVE-0-2026-11774)
Vulnerability from cvelistv5 – Published: 2026-06-11 17:54 – Updated: 2026-07-08 12:27
VLAI
EPSS
VEX
Title
389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow
Summary
An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
20 references
Impacted products
46 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Directory Server 11.5 E4S for RHEL 8 |
Unaffected:
8060020260702180044.0ca98e7e , < *
(rpm)
cpe:/a:redhat:directory_server_e4s:11.5::el8 |
|
| Red Hat | Red Hat Directory Server 11.7 E4S for RHEL 8 |
Unaffected:
8080020260702180836.f969626e , < *
(rpm)
cpe:/a:redhat:directory_server_e4s:11.7::el8 |
|
| Red Hat | Red Hat Directory Server 11.9 for RHEL 8 |
Unaffected:
8100020260702145313.37ed7c03 , < *
(rpm)
cpe:/a:redhat:directory_server:11.9::el8 |
|
| Red Hat | Red Hat Directory Server 12.2 E4S for RHEL 9 |
Unaffected:
9020020260703060155.1674d574 , < *
(rpm)
cpe:/a:redhat:directory_server_e4s:12.2::el9 |
|
| Red Hat | Red Hat Directory Server 12.4 E4S for RHEL 9 |
Unaffected:
9040020260703055735.1674d574 , < *
(rpm)
cpe:/a:redhat:directory_server_e4s:12.4::el9 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:3.2.0-8.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support |
Unaffected:
0:3.0.6-19.el10_0 , < *
(rpm)
cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support |
Unaffected:
0:1.3.11.1-13.el7_9 , < *
(rpm)
cpe:/o:redhat:rhel_els:7 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
8100020260626120929.25e700aa , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8::appstream |
|
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support |
Unaffected:
8040020260629123121.96015a92 , < *
(rpm)
cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream |
|
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On |
Unaffected:
8040020260629123121.96015a92 , < *
(rpm)
cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream |
|
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support |
Unaffected:
8060020260626130540.824efc52 , < *
(rpm)
cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream |
|
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On |
Unaffected:
8060020260626130540.824efc52 , < *
(rpm)
cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream |
|
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service |
Unaffected:
8080020260630025241.6dbb3803 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream |
|
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions |
Unaffected:
8080020260630025241.6dbb3803 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:2.8.0-8.el9_8 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb |
|
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions |
Unaffected:
0:2.2.4-19.el9_2 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:9.2::appstream |
|
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions |
Unaffected:
0:2.4.5-26.el9_4 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:9.4::appstream |
|
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support |
Unaffected:
0:2.6.1-22.el9_6 , < *
(rpm)
cpe:/a:redhat:rhel_eus:9.6::appstream cpe:/a:redhat:rhel_eus:9.6::crb |
|
| Red Hat | Red Hat Directory Server 13.2 |
Unaffected:
1783452100 , < *
(rpm)
cpe:/a:redhat:directory_server:13.2::el10 |
|
| Red Hat | Red Hat Directory Server 12 |
cpe:/a:redhat:directory_server:12 |
|
| Red Hat | Red Hat Directory Server 13 |
cpe:/a:redhat:directory_server:13 |
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6 |
|
| Red Hat | Red Hat Enterprise Linux Server (v. 7 ELS) |
cpe:/o:redhat:rhel_els:7 |
|
| Red Hat | Red Hat Enterprise Linux Server Optional (v. 7 ELS) |
cpe:/o:redhat:rhel_els:7 |
|
| Red Hat | Red Hat Directory Server 11.9 for RHEL 8 |
cpe:/a:redhat:directory_server:11.9::el8 |
|
| Red Hat | Red Hat Enterprise Linux AppStream EUS (v. 10.0) |
cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 10) |
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 8) |
cpe:/a:redhat:enterprise_linux:8::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream AUS (v.8.4) |
cpe:/a:redhat:rhel_aus:8.4::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) |
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream AUS (v.8.6) |
cpe:/a:redhat:rhel_aus:8.6::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) |
cpe:/a:redhat:rhel_eus_long_life:8.6::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream E4S (v.8.8) |
cpe:/a:redhat:rhel_e4s:8.8::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream TUS (v.8.8) |
cpe:/a:redhat:rhel_tus:8.8::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream E4S (v.9.2) |
cpe:/a:redhat:rhel_e4s:9.2::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream E4S (v.9.4) |
cpe:/a:redhat:rhel_e4s:9.4::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 9) |
cpe:/a:redhat:enterprise_linux:9::appstream |
|
| Red Hat | Red Hat Directory Server 11.5 E4S for RHEL 8 |
cpe:/a:redhat:directory_server_e4s:11.5::el8 |
|
| Red Hat | Red Hat Directory Server 11.7 E4S for RHEL 8 |
cpe:/a:redhat:directory_server_e4s:11.7::el8 |
|
| Red Hat | Red Hat Directory Server 12.2 E4S for RHEL 9 |
cpe:/a:redhat:directory_server_e4s:12.2::el9 |
|
| Red Hat | Red Hat Directory Server 12.4 E4S for RHEL 9 |
cpe:/a:redhat:directory_server_e4s:12.4::el9 |
|
| Red Hat | Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) |
cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Red Hat | Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) |
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) |
cpe:/a:redhat:enterprise_linux:9::crb |
|
| Red Hat | Red Hat Directory Server 13.2 |
cpe:/a:redhat:directory_server:13.2::el10 |
Date Public
2026-06-04 21:00
Credits
This issue was discovered by Ian Murphy (Red Hat).
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11774",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-12T15:14:06.174166Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T15:14:14.593Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux Server (v. 7 ELS)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:directory_server:11.9::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Directory Server 11.9 for RHEL 8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream (v. 10)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream (v. 8)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream (v. 9)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:directory_server_e4s:11.5::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Directory Server 11.5 E4S for RHEL 8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:directory_server_e4s:11.7::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Directory Server 11.7 E4S for RHEL 8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:directory_server_e4s:12.2::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Directory Server 12.2 E4S for RHEL 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:directory_server_e4s:12.4::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Directory Server 12.4 E4S for RHEL 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:directory_server:13.2::el10"
],
"defaultStatus": "affected",
"product": "Red Hat Directory Server 13.2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:directory_server:12"
],
"defaultStatus": "affected",
"product": "Red Hat Directory Server 12",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:directory_server:13"
],
"defaultStatus": "unaffected",
"product": "Red Hat Directory Server 13",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-04T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF \u003e 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T12:05:35.880Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-11774"
},
{
"name": "RHBZ#2484916",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11774.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36205"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36200"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36670"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36196"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36201"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36206"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36202"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36197"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36585"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36198"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36195"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36204"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36208"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36641"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36209"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36660"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:36205: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:36200: Red Hat Directory Server 11.9 for RHEL 8"
},
{
"lang": "en",
"value": "RHSA-2026:36670: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:36196: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:36201: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:36206: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:36202: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:36197: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:36585: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:36198: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:36195: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:36204: Red Hat Directory Server 11.5 E4S for RHEL 8"
},
{
"lang": "en",
"value": "RHSA-2026:36208: Red Hat Directory Server 11.7 E4S for RHEL 8"
},
{
"lang": "en",
"value": "RHSA-2026:36641: Red Hat Directory Server 12.2 E4S for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:36209: Red Hat Directory Server 12.4 E4S for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:36660: Red Hat Directory Server 13.2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-16T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-04T21:00:00.000Z",
"value": "Made public."
}
],
"title": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow",
"workarounds": [
{
"lang": "en",
"value": "No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:directory_server_e4s:11.5::el8"
],
"defaultStatus": "affected",
"packageName": "redhat-ds:11",
"product": "Red Hat Directory Server 11.5 E4S for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8060020260702180044.0ca98e7e",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:directory_server_e4s:11.7::el8"
],
"defaultStatus": "affected",
"packageName": "redhat-ds:11",
"product": "Red Hat Directory Server 11.7 E4S for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8080020260702180836.f969626e",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:directory_server:11.9::el8"
],
"defaultStatus": "affected",
"packageName": "redhat-ds:11",
"product": "Red Hat Directory Server 11.9 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8100020260702145313.37ed7c03",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:directory_server_e4s:12.2::el9"
],
"defaultStatus": "affected",
"packageName": "redhat-ds:12",
"product": "Red Hat Directory Server 12.2 E4S for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "9020020260703060155.1674d574",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:directory_server_e4s:12.4::el9"
],
"defaultStatus": "affected",
"packageName": "redhat-ds:12",
"product": "Red Hat Directory Server 12.4 E4S for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "9040020260703055735.1674d574",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "389-ds-base",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.2.0-8.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "389-ds-base",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.0.6-19.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"packageName": "389-ds-base",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.3.11.1-13.el7_9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"defaultStatus": "affected",
"packageName": "389-ds:1.4",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8100020260626120929.25e700aa",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"defaultStatus": "affected",
"packageName": "389-ds:1.4",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8040020260629123121.96015a92",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"defaultStatus": "affected",
"packageName": "389-ds:1.4",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8040020260629123121.96015a92",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"defaultStatus": "affected",
"packageName": "389-ds:1.4",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8060020260626130540.824efc52",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"defaultStatus": "affected",
"packageName": "389-ds:1.4",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8060020260626130540.824efc52",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"defaultStatus": "affected",
"packageName": "389-ds:1.4",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8080020260630025241.6dbb3803",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"defaultStatus": "affected",
"packageName": "389-ds:1.4",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8080020260630025241.6dbb3803",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"defaultStatus": "affected",
"packageName": "389-ds-base",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.8.0-8.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream"
],
"defaultStatus": "affected",
"packageName": "389-ds-base",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.2.4-19.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4::appstream"
],
"defaultStatus": "affected",
"packageName": "389-ds-base",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.4.5-26.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6::appstream",
"cpe:/a:redhat:rhel_eus:9.6::crb"
],
"defaultStatus": "affected",
"packageName": "389-ds-base",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.6.1-22.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:directory_server:13.2::el10"
],
"defaultStatus": "affected",
"packageName": "dirsrv/dirsrv-container-rhel10",
"product": "Red Hat Directory Server 13.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783452100",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:directory_server:12"
],
"defaultStatus": "affected",
"packageName": "redhat-ds:12/389-ds-base",
"product": "Red Hat Directory Server 12",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:directory_server:13"
],
"defaultStatus": "unaffected",
"packageName": "389-ds-base",
"product": "Red Hat Directory Server 13",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "389-ds-base",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Ian Murphy (Red Hat)."
}
],
"datePublic": "2026-06-04T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF \u003e 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T12:27:01.794Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:36195",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36195"
},
{
"name": "RHSA-2026:36196",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36196"
},
{
"name": "RHSA-2026:36197",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36197"
},
{
"name": "RHSA-2026:36198",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36198"
},
{
"name": "RHSA-2026:36200",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36200"
},
{
"name": "RHSA-2026:36201",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36201"
},
{
"name": "RHSA-2026:36202",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36202"
},
{
"name": "RHSA-2026:36204",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36204"
},
{
"name": "RHSA-2026:36205",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36205"
},
{
"name": "RHSA-2026:36206",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36206"
},
{
"name": "RHSA-2026:36208",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36208"
},
{
"name": "RHSA-2026:36209",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36209"
},
{
"name": "RHSA-2026:36585",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36585"
},
{
"name": "RHSA-2026:36641",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36641"
},
{
"name": "RHSA-2026:36660",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36660"
},
{
"name": "RHSA-2026:36670",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36670"
},
{
"name": "RHSA-2026:36671",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36671"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-11774"
},
{
"name": "RHBZ#2484916",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-16T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-04T21:00:00.000Z",
"value": "Made public."
}
],
"title": "389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow",
"workarounds": [
{
"lang": "en",
"value": "No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-190: Integer Overflow or Wraparound"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-11774",
"datePublished": "2026-06-11T17:54:34.539Z",
"dateReserved": "2026-06-09T11:57:25.581Z",
"dateUpdated": "2026-07-08T12:27:01.794Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-11774",
"date": "2026-07-08",
"epss": "0.0067",
"percentile": "0.47534"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-11774\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-06-11T19:16:37.853\",\"lastModified\":\"2026-07-08T13:16:27.850\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF \u003e 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Directory Server 11.5 E4S for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"redhat-ds:11\",\"cpes\":[\"cpe:/a:redhat:directory_server_e4s:11.5::el8\"],\"versions\":[{\"version\":\"8060020260702180044.0ca98e7e\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Directory Server 11.7 E4S for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"redhat-ds:11\",\"cpes\":[\"cpe:/a:redhat:directory_server_e4s:11.7::el8\"],\"versions\":[{\"version\":\"8080020260702180836.f969626e\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Directory Server 11.9 for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"redhat-ds:11\",\"cpes\":[\"cpe:/a:redhat:directory_server:11.9::el8\"],\"versions\":[{\"version\":\"8100020260702145313.37ed7c03\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Directory Server 12.2 E4S for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"redhat-ds:12\",\"cpes\":[\"cpe:/a:redhat:directory_server_e4s:12.2::el9\"],\"versions\":[{\"version\":\"9020020260703060155.1674d574\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Directory Server 12.4 E4S for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"redhat-ds:12\",\"cpes\":[\"cpe:/a:redhat:directory_server_e4s:12.4::el9\"],\"versions\":[{\"version\":\"9040020260703055735.1674d574\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"389-ds-base\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:3.2.0-8.el10_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10.0 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"389-ds-base\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux_eus:10.0\"],\"versions\":[{\"version\":\"0:3.0.6-19.el10_0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7 Extended Lifecycle Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"389-ds-base\",\"cpes\":[\"cpe:/o:redhat:rhel_els:7\"],\"versions\":[{\"version\":\"0:1.3.11.1-13.el7_9\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"389-ds:1.4\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8::appstream\"],\"versions\":[{\"version\":\"8100020260626120929.25e700aa\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"389-ds:1.4\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.4::appstream\",\"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\"],\"versions\":[{\"version\":\"8040020260629123121.96015a92\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"389-ds:1.4\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.4::appstream\",\"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\"],\"versions\":[{\"version\":\"8040020260629123121.96015a92\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"389-ds:1.4\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.6::appstream\",\"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream\"],\"versions\":[{\"version\":\"8060020260626130540.824efc52\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"389-ds:1.4\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.6::appstream\",\"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream\"],\"versions\":[{\"version\":\"8060020260626130540.824efc52\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.8 Telecommunications Update Service\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"389-ds:1.4\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.8::appstream\",\"cpe:/a:redhat:rhel_tus:8.8::appstream\"],\"versions\":[{\"version\":\"8080020260630025241.6dbb3803\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"389-ds:1.4\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.8::appstream\",\"cpe:/a:redhat:rhel_tus:8.8::appstream\"],\"versions\":[{\"version\":\"8080020260630025241.6dbb3803\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"389-ds-base\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::appstream\",\"cpe:/a:redhat:enterprise_linux:9::crb\"],\"versions\":[{\"version\":\"0:2.8.0-8.el9_8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"389-ds-base\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.2::appstream\"],\"versions\":[{\"version\":\"0:2.2.4-19.el9_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"389-ds-base\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.4::appstream\"],\"versions\":[{\"version\":\"0:2.4.5-26.el9_4\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.6 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"389-ds-base\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.6::appstream\",\"cpe:/a:redhat:rhel_eus:9.6::crb\"],\"versions\":[{\"version\":\"0:2.6.1-22.el9_6\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Directory Server 13.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"dirsrv/dirsrv-container-rhel10\",\"cpes\":[\"cpe:/a:redhat:directory_server:13.2::el10\"],\"versions\":[{\"version\":\"1783452100\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Directory Server 12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"redhat-ds:12/389-ds-base\",\"cpes\":[\"cpe:/a:redhat:directory_server:12\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Directory Server 13\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"389-ds-base\",\"cpes\":[\"cpe:/a:redhat:directory_server:13\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"389-ds-base\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux Server (v. 7 ELS)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:rhel_els:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux Server Optional (v. 7 ELS)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:rhel_els:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Directory Server 11.9 for RHEL 8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:directory_server:11.9::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream EUS (v. 10.0)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux_eus:10.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 10)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 8)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream AUS (v.8.4)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.4::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream AUS (v.8.6)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.6::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream E4S (v.8.8)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.8::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream TUS (v.8.8)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_tus:8.8::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream E4S (v.9.2)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.2::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream E4S (v.9.4)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.4::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 9)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Directory Server 11.5 E4S for RHEL 8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:directory_server_e4s:11.5::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Directory Server 11.7 E4S for RHEL 8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:directory_server_e4s:11.7::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Directory Server 12.2 E4S for RHEL 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:directory_server_e4s:12.2::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Directory Server 12.4 E4S for RHEL 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:directory_server_e4s:12.4::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux_eus:10.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::crb\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Directory Server 13.2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:directory_server:13.2::el10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Directory Server 12\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:directory_server:12\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Directory Server 13\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:directory_server:13\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H\",\"baseScore\":7.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H\",\"baseScore\":7.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-12T15:14:06.174166Z\",\"id\":\"CVE-2026-11774\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36195\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36196\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36197\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36198\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36200\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36201\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36202\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36204\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36205\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36206\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36208\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36209\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36585\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36641\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36660\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36670\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36671\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-11774\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2484916\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36195\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36196\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36197\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36198\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36200\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36201\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36202\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36204\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36205\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36206\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36208\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36209\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36585\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36641\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36660\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36670\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-11774\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2484916\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11774.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:directory_server:11\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Directory Server 11\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:directory_server:12\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Directory Server 12\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:directory_server:13\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Directory Server 13\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-16T00:00:00.000Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-06-04T21:00:00.000Z\", \"value\": \"Made public.\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-06-04T21:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-11774\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2484916\", \"name\": \"RHBZ#2484916\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11774.json\", \"tags\": [\"x_sadp-csaf-vex\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF \u003e 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-190\", \"description\": \"Integer Overflow or Wraparound\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-07-07T12:04:49.475Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-11774\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-12T15:14:06.174166Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-12T15:14:10.941Z\"}}], \"cna\": {\"title\": \"389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow\", \"credits\": [{\"lang\": \"en\", \"value\": \"This issue was discovered by Ian Murphy (Red Hat).\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:directory_server_e4s:11.5::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Directory Server 11.5 E4S for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"8060020260702180044.0ca98e7e\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"redhat-ds:11\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:directory_server_e4s:11.7::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Directory Server 11.7 E4S for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"8080020260702180836.f969626e\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"redhat-ds:11\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:directory_server:11.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Directory Server 11.9 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"8100020260702145313.37ed7c03\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"redhat-ds:11\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:directory_server_e4s:12.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Directory Server 12.4 E4S for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"9040020260703055735.1674d574\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"redhat-ds:12\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.2.0-8.el10_2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"389-ds-base\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:rhel_els:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7 Extended Lifecycle Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.3.11.1-13.el7_9\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"389-ds-base\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"8100020260626120929.25e700aa\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"389-ds:1.4\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.4::appstream\", \"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"8040020260629123121.96015a92\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"389-ds:1.4\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.4::appstream\", \"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"8040020260629123121.96015a92\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"389-ds:1.4\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.6::appstream\", \"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"8060020260626130540.824efc52\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"389-ds:1.4\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.6::appstream\", \"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"8060020260626130540.824efc52\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"389-ds:1.4\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.8::appstream\", \"cpe:/a:redhat:rhel_tus:8.8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.8 Telecommunications Update Service\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"8080020260630025241.6dbb3803\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"389-ds:1.4\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.8::appstream\", \"cpe:/a:redhat:rhel_tus:8.8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"8080020260630025241.6dbb3803\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"389-ds:1.4\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::appstream\", \"cpe:/a:redhat:enterprise_linux:9::crb\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.8.0-8.el9_8\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"389-ds-base\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.4::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.4.5-26.el9_4\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"389-ds-base\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:directory_server:12\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Directory Server 12\", \"packageName\": \"redhat-ds:12/389-ds-base\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:directory_server:13\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Directory Server 13\", \"packageName\": \"389-ds-base\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"389-ds-base\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-16T00:00:00.000Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-06-04T21:00:00.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-06-04T21:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2026:36195\", \"name\": \"RHSA-2026:36195\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36196\", \"name\": \"RHSA-2026:36196\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36197\", \"name\": \"RHSA-2026:36197\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36198\", \"name\": \"RHSA-2026:36198\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36200\", \"name\": \"RHSA-2026:36200\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36201\", \"name\": \"RHSA-2026:36201\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36202\", \"name\": \"RHSA-2026:36202\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36204\", \"name\": \"RHSA-2026:36204\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36205\", \"name\": \"RHSA-2026:36205\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36206\", \"name\": \"RHSA-2026:36206\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36208\", \"name\": \"RHSA-2026:36208\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36209\", \"name\": \"RHSA-2026:36209\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2026-11774\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2484916\", \"name\": \"RHBZ#2484916\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF \u003e 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-190\", \"description\": \"Integer Overflow or Wraparound\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-07-07T18:26:23.666Z\"}, \"x_redhatCweChain\": \"CWE-190: Integer Overflow or Wraparound\"}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-11774\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-07T18:26:23.666Z\", \"dateReserved\": \"2026-06-09T11:57:25.581Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2026-06-11T17:54:34.539Z\", \"assignerShortName\": \"redhat\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:36204
Vulnerability from csaf_redhat - Published: 2026-07-07 12:30 - Updated: 2026-07-08 19:27Summary
Red Hat Security Advisory: redhat-ds:11 security update
Severity
Important
Notes
Topic: An update for the redhat-ds:11 module is now available for Red Hat Directory Server 11.5 E4S for RHEL 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages for server administration.
Security Fix(es):
* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)
* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.src::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debugsource-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-devel-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:cockpit-389-ds-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:python3-lib389-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.
7.6 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.src::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debugsource-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-devel-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:cockpit-389-ds-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:python3-lib389-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
14 references
Acknowledgments
Red Hat
Ian Murphy
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for the redhat-ds:11 module is now available for Red Hat Directory Server 11.5 E4S for RHEL 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages for server administration.\n\nSecurity Fix(es):\n\n* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)\n\n* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:36204",
"url": "https://access.redhat.com/errata/RHSA-2026:36204"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36204.json"
}
],
"title": "Red Hat Security Advisory: redhat-ds:11 security update",
"tracking": {
"current_release_date": "2026-07-08T19:27:04+00:00",
"generator": {
"date": "2026-07-08T19:27:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:36204",
"initial_release_date": "2026-07-07T12:30:15+00:00",
"revision_history": [
{
"date": "2026-07-07T12:30:15+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-07T12:30:15+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-08T19:27:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Directory Server 11.5 E4S for RHEL 8",
"product": {
"name": "Red Hat Directory Server 11.5 E4S for RHEL 8",
"product_id": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:directory_server_e4s:11.5::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Directory Server"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.src::redhat-ds:11",
"product": {
"name": "389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.src (redhat-ds:11)",
"product_id": "389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.src::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@1.4.3.34-7.module%2Bel8dsrv%2B24471%2B245dd8e2?arch=src\u0026rpmmod=redhat-ds:11:8060020260702180044:0ca98e7e"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@1.4.3.34-7.module%2Bel8dsrv%2B24471%2B245dd8e2?arch=x86_64\u0026rpmmod=redhat-ds:11:8060020260702180044:0ca98e7e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@1.4.3.34-7.module%2Bel8dsrv%2B24471%2B245dd8e2?arch=x86_64\u0026rpmmod=redhat-ds:11:8060020260702180044:0ca98e7e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debugsource-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-debugsource-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-debugsource-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debugsource@1.4.3.34-7.module%2Bel8dsrv%2B24471%2B245dd8e2?arch=x86_64\u0026rpmmod=redhat-ds:11:8060020260702180044:0ca98e7e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-devel-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-devel-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-devel-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-devel@1.4.3.34-7.module%2Bel8dsrv%2B24471%2B245dd8e2?arch=x86_64\u0026rpmmod=redhat-ds:11:8060020260702180044:0ca98e7e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-legacy-tools-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-legacy-tools-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-legacy-tools-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-legacy-tools@1.4.3.34-7.module%2Bel8dsrv%2B24471%2B245dd8e2?arch=x86_64\u0026rpmmod=redhat-ds:11:8060020260702180044:0ca98e7e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-legacy-tools-debuginfo@1.4.3.34-7.module%2Bel8dsrv%2B24471%2B245dd8e2?arch=x86_64\u0026rpmmod=redhat-ds:11:8060020260702180044:0ca98e7e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-libs-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-libs-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@1.4.3.34-7.module%2Bel8dsrv%2B24471%2B245dd8e2?arch=x86_64\u0026rpmmod=redhat-ds:11:8060020260702180044:0ca98e7e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-libs-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-libs-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@1.4.3.34-7.module%2Bel8dsrv%2B24471%2B245dd8e2?arch=x86_64\u0026rpmmod=redhat-ds:11:8060020260702180044:0ca98e7e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-snmp-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-snmp-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp@1.4.3.34-7.module%2Bel8dsrv%2B24471%2B245dd8e2?arch=x86_64\u0026rpmmod=redhat-ds:11:8060020260702180044:0ca98e7e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-snmp-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-snmp-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@1.4.3.34-7.module%2Bel8dsrv%2B24471%2B245dd8e2?arch=x86_64\u0026rpmmod=redhat-ds:11:8060020260702180044:0ca98e7e"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "cockpit-389-ds-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11",
"product": {
"name": "cockpit-389-ds-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch (redhat-ds:11)",
"product_id": "cockpit-389-ds-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-389-ds@1.4.3.34-7.module%2Bel8dsrv%2B24471%2B245dd8e2?arch=noarch\u0026rpmmod=redhat-ds:11:8060020260702180044:0ca98e7e"
}
}
},
{
"category": "product_version",
"name": "python3-lib389-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11",
"product": {
"name": "python3-lib389-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch (redhat-ds:11)",
"product_id": "python3-lib389-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-lib389@1.4.3.34-7.module%2Bel8dsrv%2B24471%2B245dd8e2?arch=noarch\u0026rpmmod=redhat-ds:11:8060020260702180044:0ca98e7e"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.src (redhat-ds:11) as a component of Red Hat Directory Server 11.5 E4S for RHEL 8",
"product_id": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.src::redhat-ds:11"
},
"product_reference": "389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.src::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.5 E4S for RHEL 8",
"product_id": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.5 E4S for RHEL 8",
"product_id": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.5 E4S for RHEL 8",
"product_id": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debugsource-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-debugsource-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.5 E4S for RHEL 8",
"product_id": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-devel-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-devel-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-legacy-tools-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.5 E4S for RHEL 8",
"product_id": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-legacy-tools-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.5 E4S for RHEL 8",
"product_id": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.5 E4S for RHEL 8",
"product_id": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-libs-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.5 E4S for RHEL 8",
"product_id": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-libs-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.5 E4S for RHEL 8",
"product_id": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-snmp-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.5 E4S for RHEL 8",
"product_id": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-389-ds-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch (redhat-ds:11) as a component of Red Hat Directory Server 11.5 E4S for RHEL 8",
"product_id": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:cockpit-389-ds-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11"
},
"product_reference": "cockpit-389-ds-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-lib389-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch (redhat-ds:11) as a component of Red Hat Directory Server 11.5 E4S for RHEL 8",
"product_id": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:python3-lib389-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11"
},
"product_reference": "python3-lib389-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11610",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-04-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484414"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server\n(389-ds-base). After a successful SASL bind with integrity protection (SSF \u003e 0),\nan authenticated attacker can send a specially crafted oversized LDAP UNBIND packet\nthat is copied into a 512-byte heap receive buffer without a bounds check in\nsasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of\nattacker-controlled data to overflow the buffer, causing a denial of service (server\ncrash). In FreeIPA and Red Hat Identity Management deployments, any domain user with\na valid Kerberos ticket, any enrolled host, or any service account can trigger this\nvulnerability over the network after authenticating via GSSAPI.\nThe vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and\nwas not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow\nin schema.c only.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important impact. After a successful SASL bind with integrity protection (SSF \u003e 0), an authenticated remote attacker can send a crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv(). Up to roughly two megabytes of attacker-controlled data can overflow the buffer, reliably crashing ns-slapd on production builds. Exploitation requires a valid SASL-authenticated LDAP session, not Directory Manager access. Any user who can bind with SASL mechanisms such as GSSAPI/Kerberos or DIGEST-MD5 can trigger the denial of service. In deployments where domain users, enrolled hosts, and service accounts routinely authenticate to the directory over Kerberos, the attack surface includes any such principal with network access to LDAP. This flaw is independent of CVE-2025-14905, which patched a separate heap overflow in schema.c and did not modify sasl_io.c.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.src::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debugsource-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-devel-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:cockpit-389-ds-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:python3-lib389-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11610"
},
{
"category": "external",
"summary": "RHBZ#2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11610"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610"
}
],
"release_date": "2026-07-07T09:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-07T12:30:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.src::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debugsource-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-devel-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:cockpit-389-ds-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:python3-lib389-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36204"
},
{
"category": "workaround",
"details": "There is no complete workaround for this flaw.\nMitigations that reduce exposure:\n1. Restrict network access to LDAP ports (389/636) to trusted networks only.\n Note: In FreeIPA/IdM deployments, enrolled clients require LDAP access and\n this may not be practical.\n2. If DIGEST-MD5 is not required, disable it via nsslapd-allowed-sasl-mechanisms\n in cn=config. GSSAPI/Kerberos cannot be disabled in FreeIPA/IdM without breaking\n domain authentication.\n3. Monitor for oversized LDAP UNBIND packets (standard UNBIND is 7 bytes; alert on\n UNBIND packets exceeding ~100 bytes).\n4. Lowering nsslapd-maxbersize reduces maximum overflow size but does not eliminate\n the vulnerability.",
"product_ids": [
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.src::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debugsource-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-devel-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:cockpit-389-ds-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:python3-lib389-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.src::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debugsource-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-devel-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:cockpit-389-ds-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:python3-lib389-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND"
},
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11774",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484916"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF \u003e 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important. After a successful SASL bind with integrity protection, an authenticated attacker can send a SASL-framed packet whose length prefix wraps when processed in sasl_io_start_packet(), bypassing nsslapd-maxsasliosize and causing a heap buffer overflow of up to approximately two megabytes of attacker-controlled data.\n\nThis flaw is independent of CVE-2025-14905 (schema.c). Any domain user with a Kerberos ticket can trigger it remotely after GSSAPI authentication. Red Hat assigns C:L/I:L rather than Critical because remote code execution on current platforms with glibc 2.32+ is blocked by tcache safe linking; RCE was demonstrated on RHEL 8 with glibc 2.28 but required a heap address leak. Denial of service is reliable on all platforms.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.src::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debugsource-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-devel-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:cockpit-389-ds-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:python3-lib389-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11774"
},
{
"category": "external",
"summary": "RHBZ#2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11774",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905"
}
],
"release_date": "2026-06-04T21:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-07T12:30:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.src::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debugsource-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-devel-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:cockpit-389-ds-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:python3-lib389-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36204"
},
{
"category": "workaround",
"details": "No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.",
"product_ids": [
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.src::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debugsource-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-devel-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:cockpit-389-ds-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:python3-lib389-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.src::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-debugsource-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-devel-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.x86_64::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:cockpit-389-ds-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11",
"BaseOS-8.6.0.Z.E4S-DirSrv-11.5-E4S:python3-lib389-0:1.4.3.34-7.module+el8dsrv+24471+245dd8e2.noarch::redhat-ds:11"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow"
}
]
}
RHSA-2026:36205
Vulnerability from csaf_redhat - Published: 2026-07-07 13:09 - Updated: 2026-07-08 19:27Summary
Red Hat Security Advisory: 389-ds-base security update
Severity
Important
Notes
Topic: An update for 389-ds-base is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: 389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.
Security Fix(es):
* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)
* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.
8.8 (High)
Affected products
Fixed
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.
7.6 (High)
Affected products
Fixed
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
14 references
Acknowledgments
Red Hat
Ian Murphy
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for 389-ds-base is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.\n\nSecurity Fix(es):\n\n* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)\n\n* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:36205",
"url": "https://access.redhat.com/errata/RHSA-2026:36205"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36205.json"
}
],
"title": "Red Hat Security Advisory: 389-ds-base security update",
"tracking": {
"current_release_date": "2026-07-08T19:27:12+00:00",
"generator": {
"date": "2026-07-08T19:27:12+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:36205",
"initial_release_date": "2026-07-07T13:09:25+00:00",
"revision_history": [
{
"date": "2026-07-07T13:09:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-07T13:09:25+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-08T19:27:12+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 7 ELS)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_els:7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product": {
"name": "Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_els:7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:1.3.11.1-13.el7_9.src",
"product": {
"name": "389-ds-base-0:1.3.11.1-13.el7_9.src",
"product_id": "389-ds-base-0:1.3.11.1-13.el7_9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@1.3.11.1-13.el7_9?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:1.3.11.1-13.el7_9.x86_64",
"product": {
"name": "389-ds-base-0:1.3.11.1-13.el7_9.x86_64",
"product_id": "389-ds-base-0:1.3.11.1-13.el7_9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@1.3.11.1-13.el7_9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:1.3.11.1-13.el7_9.x86_64",
"product": {
"name": "389-ds-base-libs-0:1.3.11.1-13.el7_9.x86_64",
"product_id": "389-ds-base-libs-0:1.3.11.1-13.el7_9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@1.3.11.1-13.el7_9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"product": {
"name": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"product_id": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@1.3.11.1-13.el7_9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-devel-0:1.3.11.1-13.el7_9.x86_64",
"product": {
"name": "389-ds-base-devel-0:1.3.11.1-13.el7_9.x86_64",
"product_id": "389-ds-base-devel-0:1.3.11.1-13.el7_9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-devel@1.3.11.1-13.el7_9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.x86_64",
"product": {
"name": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.x86_64",
"product_id": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp@1.3.11.1-13.el7_9?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:1.3.11.1-13.el7_9.ppc64le",
"product": {
"name": "389-ds-base-0:1.3.11.1-13.el7_9.ppc64le",
"product_id": "389-ds-base-0:1.3.11.1-13.el7_9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@1.3.11.1-13.el7_9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64le",
"product": {
"name": "389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64le",
"product_id": "389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@1.3.11.1-13.el7_9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"product": {
"name": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"product_id": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@1.3.11.1-13.el7_9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64le",
"product": {
"name": "389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64le",
"product_id": "389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-devel@1.3.11.1-13.el7_9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64le",
"product": {
"name": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64le",
"product_id": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp@1.3.11.1-13.el7_9?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:1.3.11.1-13.el7_9.ppc64",
"product": {
"name": "389-ds-base-0:1.3.11.1-13.el7_9.ppc64",
"product_id": "389-ds-base-0:1.3.11.1-13.el7_9.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@1.3.11.1-13.el7_9?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64",
"product": {
"name": "389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64",
"product_id": "389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-devel@1.3.11.1-13.el7_9?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64",
"product": {
"name": "389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64",
"product_id": "389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@1.3.11.1-13.el7_9?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64",
"product": {
"name": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64",
"product_id": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp@1.3.11.1-13.el7_9?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64",
"product": {
"name": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64",
"product_id": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@1.3.11.1-13.el7_9?arch=ppc64"
}
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:1.3.11.1-13.el7_9.s390x",
"product": {
"name": "389-ds-base-0:1.3.11.1-13.el7_9.s390x",
"product_id": "389-ds-base-0:1.3.11.1-13.el7_9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@1.3.11.1-13.el7_9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-devel-0:1.3.11.1-13.el7_9.s390x",
"product": {
"name": "389-ds-base-devel-0:1.3.11.1-13.el7_9.s390x",
"product_id": "389-ds-base-devel-0:1.3.11.1-13.el7_9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-devel@1.3.11.1-13.el7_9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:1.3.11.1-13.el7_9.s390x",
"product": {
"name": "389-ds-base-libs-0:1.3.11.1-13.el7_9.s390x",
"product_id": "389-ds-base-libs-0:1.3.11.1-13.el7_9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@1.3.11.1-13.el7_9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.s390x",
"product": {
"name": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.s390x",
"product_id": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp@1.3.11.1-13.el7_9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.s390x",
"product": {
"name": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.s390x",
"product_id": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@1.3.11.1-13.el7_9?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:1.3.11.1-13.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64le"
},
"product_reference": "389-ds-base-0:1.3.11.1-13.el7_9.ppc64le",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:1.3.11.1-13.el7_9.src as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src"
},
"product_reference": "389-ds-base-0:1.3.11.1-13.el7_9.src",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:1.3.11.1-13.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.x86_64"
},
"product_reference": "389-ds-base-0:1.3.11.1-13.el7_9.x86_64",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le"
},
"product_reference": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64"
},
"product_reference": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64le"
},
"product_reference": "389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64le",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:1.3.11.1-13.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.x86_64"
},
"product_reference": "389-ds-base-libs-0:1.3.11.1-13.el7_9.x86_64",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:1.3.11.1-13.el7_9.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64"
},
"product_reference": "389-ds-base-0:1.3.11.1-13.el7_9.ppc64",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:1.3.11.1-13.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.s390x"
},
"product_reference": "389-ds-base-0:1.3.11.1-13.el7_9.s390x",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:1.3.11.1-13.el7_9.src as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src"
},
"product_reference": "389-ds-base-0:1.3.11.1-13.el7_9.src",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64"
},
"product_reference": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le"
},
"product_reference": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.s390x"
},
"product_reference": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.s390x",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64"
},
"product_reference": "389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64"
},
"product_reference": "389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64le"
},
"product_reference": "389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64le",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:1.3.11.1-13.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.s390x"
},
"product_reference": "389-ds-base-devel-0:1.3.11.1-13.el7_9.s390x",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:1.3.11.1-13.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.x86_64"
},
"product_reference": "389-ds-base-devel-0:1.3.11.1-13.el7_9.x86_64",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64"
},
"product_reference": "389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:1.3.11.1-13.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.s390x"
},
"product_reference": "389-ds-base-libs-0:1.3.11.1-13.el7_9.s390x",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64"
},
"product_reference": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64le"
},
"product_reference": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64le",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.s390x"
},
"product_reference": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.s390x",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.x86_64"
},
"product_reference": "389-ds-base-snmp-0:1.3.11.1-13.el7_9.x86_64",
"relates_to_product_reference": "7Server-optional-ELS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11610",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-04-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484414"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server\n(389-ds-base). After a successful SASL bind with integrity protection (SSF \u003e 0),\nan authenticated attacker can send a specially crafted oversized LDAP UNBIND packet\nthat is copied into a 512-byte heap receive buffer without a bounds check in\nsasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of\nattacker-controlled data to overflow the buffer, causing a denial of service (server\ncrash). In FreeIPA and Red Hat Identity Management deployments, any domain user with\na valid Kerberos ticket, any enrolled host, or any service account can trigger this\nvulnerability over the network after authenticating via GSSAPI.\nThe vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and\nwas not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow\nin schema.c only.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important impact. After a successful SASL bind with integrity protection (SSF \u003e 0), an authenticated remote attacker can send a crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv(). Up to roughly two megabytes of attacker-controlled data can overflow the buffer, reliably crashing ns-slapd on production builds. Exploitation requires a valid SASL-authenticated LDAP session, not Directory Manager access. Any user who can bind with SASL mechanisms such as GSSAPI/Kerberos or DIGEST-MD5 can trigger the denial of service. In deployments where domain users, enrolled hosts, and service accounts routinely authenticate to the directory over Kerberos, the attack surface includes any such principal with network access to LDAP. This flaw is independent of CVE-2025-14905, which patched a separate heap overflow in schema.c and did not modify sasl_io.c.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src",
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.x86_64",
"7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11610"
},
{
"category": "external",
"summary": "RHBZ#2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11610"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610"
}
],
"release_date": "2026-07-07T09:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-07T13:09:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src",
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.x86_64",
"7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36205"
},
{
"category": "workaround",
"details": "There is no complete workaround for this flaw.\nMitigations that reduce exposure:\n1. Restrict network access to LDAP ports (389/636) to trusted networks only.\n Note: In FreeIPA/IdM deployments, enrolled clients require LDAP access and\n this may not be practical.\n2. If DIGEST-MD5 is not required, disable it via nsslapd-allowed-sasl-mechanisms\n in cn=config. GSSAPI/Kerberos cannot be disabled in FreeIPA/IdM without breaking\n domain authentication.\n3. Monitor for oversized LDAP UNBIND packets (standard UNBIND is 7 bytes; alert on\n UNBIND packets exceeding ~100 bytes).\n4. Lowering nsslapd-maxbersize reduces maximum overflow size but does not eliminate\n the vulnerability.",
"product_ids": [
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src",
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.x86_64",
"7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src",
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.x86_64",
"7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND"
},
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11774",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484916"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF \u003e 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important. After a successful SASL bind with integrity protection, an authenticated attacker can send a SASL-framed packet whose length prefix wraps when processed in sasl_io_start_packet(), bypassing nsslapd-maxsasliosize and causing a heap buffer overflow of up to approximately two megabytes of attacker-controlled data.\n\nThis flaw is independent of CVE-2025-14905 (schema.c). Any domain user with a Kerberos ticket can trigger it remotely after GSSAPI authentication. Red Hat assigns C:L/I:L rather than Critical because remote code execution on current platforms with glibc 2.32+ is blocked by tcache safe linking; RCE was demonstrated on RHEL 8 with glibc 2.28 but required a heap address leak. Denial of service is reliable on all platforms.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src",
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.x86_64",
"7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11774"
},
{
"category": "external",
"summary": "RHBZ#2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11774",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905"
}
],
"release_date": "2026-06-04T21:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-07T13:09:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src",
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.x86_64",
"7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36205"
},
{
"category": "workaround",
"details": "No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.",
"product_ids": [
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src",
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.x86_64",
"7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src",
"7Server-ELS:389-ds-base-0:1.3.11.1-13.el7_9.x86_64",
"7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-0:1.3.11.1-13.el7_9.src",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-debuginfo-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-devel-0:1.3.11.1-13.el7_9.x86_64",
"7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-libs-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.ppc64le",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.s390x",
"7Server-optional-ELS:389-ds-base-snmp-0:1.3.11.1-13.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow"
}
]
}
RHSA-2026:36206
Vulnerability from csaf_redhat - Published: 2026-07-07 13:05 - Updated: 2026-07-08 19:27Summary
Red Hat Security Advisory: 389-ds:1.4 security update
Severity
Important
Notes
Topic: An update for the 389-ds:1.4 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: 389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.
Security Fix(es):
* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)
* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.
8.8 (High)
Affected products
Fixed
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.
7.6 (High)
Affected products
Fixed
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
14 references
Acknowledgments
Red Hat
Ian Murphy
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for the 389-ds:1.4 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. \n\nSecurity Fix(es):\n\n* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)\n\n* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:36206",
"url": "https://access.redhat.com/errata/RHSA-2026:36206"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36206.json"
}
],
"title": "Red Hat Security Advisory: 389-ds:1.4 security update",
"tracking": {
"current_release_date": "2026-07-08T19:27:07+00:00",
"generator": {
"date": "2026-07-08T19:27:07+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:36206",
"initial_release_date": "2026-07-07T13:05:55+00:00",
"revision_history": [
{
"date": "2026-07-07T13:05:55+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-07T13:05:55+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-08T19:27:07+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product": {
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_aus:8.4::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"product": {
"name": "389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src (389-ds:1.4)",
"product_id": "389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@1.4.3.34-5.module%2Bel8.4.0%2B24472%2B7ce5ce41?arch=src\u0026rpmmod=389-ds:1.4:8040020260629123121:96015a92"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product": {
"name": "389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4)",
"product_id": "389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@1.4.3.34-5.module%2Bel8.4.0%2B24472%2B7ce5ce41?arch=x86_64\u0026rpmmod=389-ds:1.4:8040020260629123121:96015a92"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product": {
"name": "389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4)",
"product_id": "389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@1.4.3.34-5.module%2Bel8.4.0%2B24472%2B7ce5ce41?arch=x86_64\u0026rpmmod=389-ds:1.4:8040020260629123121:96015a92"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product": {
"name": "389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4)",
"product_id": "389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debugsource@1.4.3.34-5.module%2Bel8.4.0%2B24472%2B7ce5ce41?arch=x86_64\u0026rpmmod=389-ds:1.4:8040020260629123121:96015a92"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product": {
"name": "389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4)",
"product_id": "389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-devel@1.4.3.34-5.module%2Bel8.4.0%2B24472%2B7ce5ce41?arch=x86_64\u0026rpmmod=389-ds:1.4:8040020260629123121:96015a92"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product": {
"name": "389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4)",
"product_id": "389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-legacy-tools@1.4.3.34-5.module%2Bel8.4.0%2B24472%2B7ce5ce41?arch=x86_64\u0026rpmmod=389-ds:1.4:8040020260629123121:96015a92"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product": {
"name": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4)",
"product_id": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-legacy-tools-debuginfo@1.4.3.34-5.module%2Bel8.4.0%2B24472%2B7ce5ce41?arch=x86_64\u0026rpmmod=389-ds:1.4:8040020260629123121:96015a92"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product": {
"name": "389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4)",
"product_id": "389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@1.4.3.34-5.module%2Bel8.4.0%2B24472%2B7ce5ce41?arch=x86_64\u0026rpmmod=389-ds:1.4:8040020260629123121:96015a92"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product": {
"name": "389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4)",
"product_id": "389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@1.4.3.34-5.module%2Bel8.4.0%2B24472%2B7ce5ce41?arch=x86_64\u0026rpmmod=389-ds:1.4:8040020260629123121:96015a92"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product": {
"name": "389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4)",
"product_id": "389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp@1.4.3.34-5.module%2Bel8.4.0%2B24472%2B7ce5ce41?arch=x86_64\u0026rpmmod=389-ds:1.4:8040020260629123121:96015a92"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product": {
"name": "389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4)",
"product_id": "389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@1.4.3.34-5.module%2Bel8.4.0%2B24472%2B7ce5ce41?arch=x86_64\u0026rpmmod=389-ds:1.4:8040020260629123121:96015a92"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4",
"product": {
"name": "python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch (389-ds:1.4)",
"product_id": "python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-lib389@1.4.3.34-5.module%2Bel8.4.0%2B24472%2B7ce5ce41?arch=noarch\u0026rpmmod=389-ds:1.4:8040020260629123121:96015a92"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4"
},
"product_reference": "389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4"
},
"product_reference": "python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4"
},
"product_reference": "389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4"
},
"product_reference": "python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11610",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-04-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484414"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server\n(389-ds-base). After a successful SASL bind with integrity protection (SSF \u003e 0),\nan authenticated attacker can send a specially crafted oversized LDAP UNBIND packet\nthat is copied into a 512-byte heap receive buffer without a bounds check in\nsasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of\nattacker-controlled data to overflow the buffer, causing a denial of service (server\ncrash). In FreeIPA and Red Hat Identity Management deployments, any domain user with\na valid Kerberos ticket, any enrolled host, or any service account can trigger this\nvulnerability over the network after authenticating via GSSAPI.\nThe vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and\nwas not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow\nin schema.c only.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important impact. After a successful SASL bind with integrity protection (SSF \u003e 0), an authenticated remote attacker can send a crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv(). Up to roughly two megabytes of attacker-controlled data can overflow the buffer, reliably crashing ns-slapd on production builds. Exploitation requires a valid SASL-authenticated LDAP session, not Directory Manager access. Any user who can bind with SASL mechanisms such as GSSAPI/Kerberos or DIGEST-MD5 can trigger the denial of service. In deployments where domain users, enrolled hosts, and service accounts routinely authenticate to the directory over Kerberos, the attack surface includes any such principal with network access to LDAP. This flaw is independent of CVE-2025-14905, which patched a separate heap overflow in schema.c and did not modify sasl_io.c.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11610"
},
{
"category": "external",
"summary": "RHBZ#2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11610"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610"
}
],
"release_date": "2026-07-07T09:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-07T13:05:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36206"
},
{
"category": "workaround",
"details": "There is no complete workaround for this flaw.\nMitigations that reduce exposure:\n1. Restrict network access to LDAP ports (389/636) to trusted networks only.\n Note: In FreeIPA/IdM deployments, enrolled clients require LDAP access and\n this may not be practical.\n2. If DIGEST-MD5 is not required, disable it via nsslapd-allowed-sasl-mechanisms\n in cn=config. GSSAPI/Kerberos cannot be disabled in FreeIPA/IdM without breaking\n domain authentication.\n3. Monitor for oversized LDAP UNBIND packets (standard UNBIND is 7 bytes; alert on\n UNBIND packets exceeding ~100 bytes).\n4. Lowering nsslapd-maxbersize reduces maximum overflow size but does not eliminate\n the vulnerability.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND"
},
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11774",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484916"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF \u003e 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important. After a successful SASL bind with integrity protection, an authenticated attacker can send a SASL-framed packet whose length prefix wraps when processed in sasl_io_start_packet(), bypassing nsslapd-maxsasliosize and causing a heap buffer overflow of up to approximately two megabytes of attacker-controlled data.\n\nThis flaw is independent of CVE-2025-14905 (schema.c). Any domain user with a Kerberos ticket can trigger it remotely after GSSAPI authentication. Red Hat assigns C:L/I:L rather than Critical because remote code execution on current platforms with glibc 2.32+ is blocked by tcache safe linking; RCE was demonstrated on RHEL 8 with glibc 2.28 but required a heap address leak. Denial of service is reliable on all platforms.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11774"
},
{
"category": "external",
"summary": "RHBZ#2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11774",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905"
}
],
"release_date": "2026-06-04T21:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-07T13:05:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36206"
},
{
"category": "workaround",
"details": "No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.AUS:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.src::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-debugsource-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-devel-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-libs-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:389-ds-base-snmp-debuginfo-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.x86_64::389-ds:1.4",
"AppStream-8.4.0.Z.EUS.EXTENSION:python3-lib389-0:1.4.3.34-5.module+el8.4.0+24472+7ce5ce41.noarch::389-ds:1.4"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow"
}
]
}
RHSA-2026:36208
Vulnerability from csaf_redhat - Published: 2026-07-07 12:33 - Updated: 2026-07-08 19:26Summary
Red Hat Security Advisory: redhat-ds:11 security update
Severity
Important
Notes
Topic: An update for the redhat-ds:11 module is now available for Red Hat Directory Server 11.7 E4S for RHEL 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages for server administration.
Security Fix(es):
* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)
* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.src::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debugsource-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-devel-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:cockpit-389-ds-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:python3-lib389-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.
7.6 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.src::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debugsource-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-devel-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:cockpit-389-ds-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:python3-lib389-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
14 references
Acknowledgments
Red Hat
Ian Murphy
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for the redhat-ds:11 module is now available for Red Hat Directory Server 11.7 E4S for RHEL 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages for server administration.\n\nSecurity Fix(es):\n\n* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)\n\n* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:36208",
"url": "https://access.redhat.com/errata/RHSA-2026:36208"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36208.json"
}
],
"title": "Red Hat Security Advisory: redhat-ds:11 security update",
"tracking": {
"current_release_date": "2026-07-08T19:26:48+00:00",
"generator": {
"date": "2026-07-08T19:26:48+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:36208",
"initial_release_date": "2026-07-07T12:33:15+00:00",
"revision_history": [
{
"date": "2026-07-07T12:33:15+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-07T12:33:15+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-08T19:26:48+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Directory Server 11.7 E4S for RHEL 8",
"product": {
"name": "Red Hat Directory Server 11.7 E4S for RHEL 8",
"product_id": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:directory_server_e4s:11.7::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Directory Server"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.src::redhat-ds:11",
"product": {
"name": "389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.src (redhat-ds:11)",
"product_id": "389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.src::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@1.4.3.34-16.module%2Bel8dsrv%2B24461%2Be76d504b?arch=src\u0026rpmmod=redhat-ds:11:8080020260702180836:f969626e"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@1.4.3.34-16.module%2Bel8dsrv%2B24461%2Be76d504b?arch=x86_64\u0026rpmmod=redhat-ds:11:8080020260702180836:f969626e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@1.4.3.34-16.module%2Bel8dsrv%2B24461%2Be76d504b?arch=x86_64\u0026rpmmod=redhat-ds:11:8080020260702180836:f969626e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debugsource-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-debugsource-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-debugsource-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debugsource@1.4.3.34-16.module%2Bel8dsrv%2B24461%2Be76d504b?arch=x86_64\u0026rpmmod=redhat-ds:11:8080020260702180836:f969626e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-devel-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-devel-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-devel-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-devel@1.4.3.34-16.module%2Bel8dsrv%2B24461%2Be76d504b?arch=x86_64\u0026rpmmod=redhat-ds:11:8080020260702180836:f969626e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-legacy-tools-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-legacy-tools-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-legacy-tools-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-legacy-tools@1.4.3.34-16.module%2Bel8dsrv%2B24461%2Be76d504b?arch=x86_64\u0026rpmmod=redhat-ds:11:8080020260702180836:f969626e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-legacy-tools-debuginfo@1.4.3.34-16.module%2Bel8dsrv%2B24461%2Be76d504b?arch=x86_64\u0026rpmmod=redhat-ds:11:8080020260702180836:f969626e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-libs-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-libs-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@1.4.3.34-16.module%2Bel8dsrv%2B24461%2Be76d504b?arch=x86_64\u0026rpmmod=redhat-ds:11:8080020260702180836:f969626e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-libs-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-libs-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@1.4.3.34-16.module%2Bel8dsrv%2B24461%2Be76d504b?arch=x86_64\u0026rpmmod=redhat-ds:11:8080020260702180836:f969626e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-snmp-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-snmp-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp@1.4.3.34-16.module%2Bel8dsrv%2B24461%2Be76d504b?arch=x86_64\u0026rpmmod=redhat-ds:11:8080020260702180836:f969626e"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product": {
"name": "389-ds-base-snmp-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11)",
"product_id": "389-ds-base-snmp-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@1.4.3.34-16.module%2Bel8dsrv%2B24461%2Be76d504b?arch=x86_64\u0026rpmmod=redhat-ds:11:8080020260702180836:f969626e"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "cockpit-389-ds-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11",
"product": {
"name": "cockpit-389-ds-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch (redhat-ds:11)",
"product_id": "cockpit-389-ds-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-389-ds@1.4.3.34-16.module%2Bel8dsrv%2B24461%2Be76d504b?arch=noarch\u0026rpmmod=redhat-ds:11:8080020260702180836:f969626e"
}
}
},
{
"category": "product_version",
"name": "python3-lib389-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11",
"product": {
"name": "python3-lib389-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch (redhat-ds:11)",
"product_id": "python3-lib389-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-lib389@1.4.3.34-16.module%2Bel8dsrv%2B24461%2Be76d504b?arch=noarch\u0026rpmmod=redhat-ds:11:8080020260702180836:f969626e"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.src (redhat-ds:11) as a component of Red Hat Directory Server 11.7 E4S for RHEL 8",
"product_id": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.src::redhat-ds:11"
},
"product_reference": "389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.src::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.7 E4S for RHEL 8",
"product_id": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.7 E4S for RHEL 8",
"product_id": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.7 E4S for RHEL 8",
"product_id": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debugsource-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-debugsource-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.7 E4S for RHEL 8",
"product_id": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-devel-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-devel-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-legacy-tools-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.7 E4S for RHEL 8",
"product_id": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-legacy-tools-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.7 E4S for RHEL 8",
"product_id": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.7 E4S for RHEL 8",
"product_id": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-libs-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.7 E4S for RHEL 8",
"product_id": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-libs-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.7 E4S for RHEL 8",
"product_id": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-snmp-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.7 E4S for RHEL 8",
"product_id": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-389-ds-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch (redhat-ds:11) as a component of Red Hat Directory Server 11.7 E4S for RHEL 8",
"product_id": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:cockpit-389-ds-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11"
},
"product_reference": "cockpit-389-ds-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-lib389-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch (redhat-ds:11) as a component of Red Hat Directory Server 11.7 E4S for RHEL 8",
"product_id": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:python3-lib389-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11"
},
"product_reference": "python3-lib389-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11610",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-04-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484414"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server\n(389-ds-base). After a successful SASL bind with integrity protection (SSF \u003e 0),\nan authenticated attacker can send a specially crafted oversized LDAP UNBIND packet\nthat is copied into a 512-byte heap receive buffer without a bounds check in\nsasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of\nattacker-controlled data to overflow the buffer, causing a denial of service (server\ncrash). In FreeIPA and Red Hat Identity Management deployments, any domain user with\na valid Kerberos ticket, any enrolled host, or any service account can trigger this\nvulnerability over the network after authenticating via GSSAPI.\nThe vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and\nwas not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow\nin schema.c only.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important impact. After a successful SASL bind with integrity protection (SSF \u003e 0), an authenticated remote attacker can send a crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv(). Up to roughly two megabytes of attacker-controlled data can overflow the buffer, reliably crashing ns-slapd on production builds. Exploitation requires a valid SASL-authenticated LDAP session, not Directory Manager access. Any user who can bind with SASL mechanisms such as GSSAPI/Kerberos or DIGEST-MD5 can trigger the denial of service. In deployments where domain users, enrolled hosts, and service accounts routinely authenticate to the directory over Kerberos, the attack surface includes any such principal with network access to LDAP. This flaw is independent of CVE-2025-14905, which patched a separate heap overflow in schema.c and did not modify sasl_io.c.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.src::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debugsource-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-devel-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:cockpit-389-ds-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:python3-lib389-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11610"
},
{
"category": "external",
"summary": "RHBZ#2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11610"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610"
}
],
"release_date": "2026-07-07T09:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-07T12:33:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.src::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debugsource-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-devel-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:cockpit-389-ds-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:python3-lib389-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36208"
},
{
"category": "workaround",
"details": "There is no complete workaround for this flaw.\nMitigations that reduce exposure:\n1. Restrict network access to LDAP ports (389/636) to trusted networks only.\n Note: In FreeIPA/IdM deployments, enrolled clients require LDAP access and\n this may not be practical.\n2. If DIGEST-MD5 is not required, disable it via nsslapd-allowed-sasl-mechanisms\n in cn=config. GSSAPI/Kerberos cannot be disabled in FreeIPA/IdM without breaking\n domain authentication.\n3. Monitor for oversized LDAP UNBIND packets (standard UNBIND is 7 bytes; alert on\n UNBIND packets exceeding ~100 bytes).\n4. Lowering nsslapd-maxbersize reduces maximum overflow size but does not eliminate\n the vulnerability.",
"product_ids": [
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.src::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debugsource-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-devel-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:cockpit-389-ds-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:python3-lib389-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.src::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debugsource-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-devel-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:cockpit-389-ds-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:python3-lib389-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND"
},
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11774",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484916"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF \u003e 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important. After a successful SASL bind with integrity protection, an authenticated attacker can send a SASL-framed packet whose length prefix wraps when processed in sasl_io_start_packet(), bypassing nsslapd-maxsasliosize and causing a heap buffer overflow of up to approximately two megabytes of attacker-controlled data.\n\nThis flaw is independent of CVE-2025-14905 (schema.c). Any domain user with a Kerberos ticket can trigger it remotely after GSSAPI authentication. Red Hat assigns C:L/I:L rather than Critical because remote code execution on current platforms with glibc 2.32+ is blocked by tcache safe linking; RCE was demonstrated on RHEL 8 with glibc 2.28 but required a heap address leak. Denial of service is reliable on all platforms.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.src::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debugsource-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-devel-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:cockpit-389-ds-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:python3-lib389-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11774"
},
{
"category": "external",
"summary": "RHBZ#2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11774",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905"
}
],
"release_date": "2026-06-04T21:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-07T12:33:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.src::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debugsource-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-devel-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:cockpit-389-ds-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:python3-lib389-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36208"
},
{
"category": "workaround",
"details": "No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.",
"product_ids": [
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.src::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debugsource-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-devel-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:cockpit-389-ds-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:python3-lib389-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.src::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-debugsource-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-devel-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-legacy-tools-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-libs-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:389-ds-base-snmp-debuginfo-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:cockpit-389-ds-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11",
"BaseOS-8.8.0.Z.E4S-DirSrv-11.7-E4S:python3-lib389-0:1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch::redhat-ds:11"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow"
}
]
}
RHSA-2026:36209
Vulnerability from csaf_redhat - Published: 2026-07-07 12:32 - Updated: 2026-07-08 19:26Summary
Red Hat Security Advisory: redhat-ds:12 security update
Severity
Important
Notes
Topic: An update for the redhat-ds:12 module is now available for Red Hat Directory Server 12.4 E4S for RHEL 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages for server administration.
Security Fix(es):
* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)
* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.
8.8 (High)
Affected products
Fixed
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.src::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debugsource-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-devel-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:cockpit-389-ds-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:python3-lib389-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.
7.6 (High)
Affected products
Fixed
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.src::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debugsource-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-devel-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:cockpit-389-ds-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:python3-lib389-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
14 references
Acknowledgments
Red Hat
Ian Murphy
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for the redhat-ds:12 module is now available for Red Hat Directory Server 12.4 E4S for RHEL 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages for server administration.\n\nSecurity Fix(es):\n\n* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)\n\n* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:36209",
"url": "https://access.redhat.com/errata/RHSA-2026:36209"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36209.json"
}
],
"title": "Red Hat Security Advisory: redhat-ds:12 security update",
"tracking": {
"current_release_date": "2026-07-08T19:26:49+00:00",
"generator": {
"date": "2026-07-08T19:26:49+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:36209",
"initial_release_date": "2026-07-07T12:32:40+00:00",
"revision_history": [
{
"date": "2026-07-07T12:32:40+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-07T12:32:40+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-08T19:26:49+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Directory Server 12.4 E4S for RHEL 9",
"product": {
"name": "Red Hat Directory Server 12.4 E4S for RHEL 9",
"product_id": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:directory_server_e4s:12.4::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Directory Server"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.src::redhat-ds:12",
"product": {
"name": "389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.src (redhat-ds:12)",
"product_id": "389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.src::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@2.4.5-24.module%2Bel9dsrv%2B24459%2B87716c2d?arch=src\u0026rpmmod=redhat-ds:12:9040020260703055735:1674d574"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"product": {
"name": "389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64 (redhat-ds:12)",
"product_id": "389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@2.4.5-24.module%2Bel9dsrv%2B24459%2B87716c2d?arch=x86_64\u0026rpmmod=redhat-ds:12:9040020260703055735:1674d574"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"product": {
"name": "389-ds-base-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64 (redhat-ds:12)",
"product_id": "389-ds-base-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@2.4.5-24.module%2Bel9dsrv%2B24459%2B87716c2d?arch=x86_64\u0026rpmmod=redhat-ds:12:9040020260703055735:1674d574"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debugsource-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"product": {
"name": "389-ds-base-debugsource-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64 (redhat-ds:12)",
"product_id": "389-ds-base-debugsource-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debugsource@2.4.5-24.module%2Bel9dsrv%2B24459%2B87716c2d?arch=x86_64\u0026rpmmod=redhat-ds:12:9040020260703055735:1674d574"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-devel-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"product": {
"name": "389-ds-base-devel-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64 (redhat-ds:12)",
"product_id": "389-ds-base-devel-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-devel@2.4.5-24.module%2Bel9dsrv%2B24459%2B87716c2d?arch=x86_64\u0026rpmmod=redhat-ds:12:9040020260703055735:1674d574"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"product": {
"name": "389-ds-base-libs-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64 (redhat-ds:12)",
"product_id": "389-ds-base-libs-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@2.4.5-24.module%2Bel9dsrv%2B24459%2B87716c2d?arch=x86_64\u0026rpmmod=redhat-ds:12:9040020260703055735:1674d574"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"product": {
"name": "389-ds-base-libs-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64 (redhat-ds:12)",
"product_id": "389-ds-base-libs-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@2.4.5-24.module%2Bel9dsrv%2B24459%2B87716c2d?arch=x86_64\u0026rpmmod=redhat-ds:12:9040020260703055735:1674d574"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"product": {
"name": "389-ds-base-snmp-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64 (redhat-ds:12)",
"product_id": "389-ds-base-snmp-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp@2.4.5-24.module%2Bel9dsrv%2B24459%2B87716c2d?arch=x86_64\u0026rpmmod=redhat-ds:12:9040020260703055735:1674d574"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"product": {
"name": "389-ds-base-snmp-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64 (redhat-ds:12)",
"product_id": "389-ds-base-snmp-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@2.4.5-24.module%2Bel9dsrv%2B24459%2B87716c2d?arch=x86_64\u0026rpmmod=redhat-ds:12:9040020260703055735:1674d574"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "cockpit-389-ds-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12",
"product": {
"name": "cockpit-389-ds-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch (redhat-ds:12)",
"product_id": "cockpit-389-ds-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-389-ds@2.4.5-24.module%2Bel9dsrv%2B24459%2B87716c2d?arch=noarch\u0026rpmmod=redhat-ds:12:9040020260703055735:1674d574"
}
}
},
{
"category": "product_version",
"name": "python3-lib389-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12",
"product": {
"name": "python3-lib389-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch (redhat-ds:12)",
"product_id": "python3-lib389-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-lib389@2.4.5-24.module%2Bel9dsrv%2B24459%2B87716c2d?arch=noarch\u0026rpmmod=redhat-ds:12:9040020260703055735:1674d574"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.src (redhat-ds:12) as a component of Red Hat Directory Server 12.4 E4S for RHEL 9",
"product_id": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.src::redhat-ds:12"
},
"product_reference": "389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.src::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64 (redhat-ds:12) as a component of Red Hat Directory Server 12.4 E4S for RHEL 9",
"product_id": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12"
},
"product_reference": "389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64 (redhat-ds:12) as a component of Red Hat Directory Server 12.4 E4S for RHEL 9",
"product_id": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12"
},
"product_reference": "389-ds-base-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64 (redhat-ds:12) as a component of Red Hat Directory Server 12.4 E4S for RHEL 9",
"product_id": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debugsource-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12"
},
"product_reference": "389-ds-base-debugsource-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64 (redhat-ds:12) as a component of Red Hat Directory Server 12.4 E4S for RHEL 9",
"product_id": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-devel-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12"
},
"product_reference": "389-ds-base-devel-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64 (redhat-ds:12) as a component of Red Hat Directory Server 12.4 E4S for RHEL 9",
"product_id": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12"
},
"product_reference": "389-ds-base-libs-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64 (redhat-ds:12) as a component of Red Hat Directory Server 12.4 E4S for RHEL 9",
"product_id": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12"
},
"product_reference": "389-ds-base-libs-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64 (redhat-ds:12) as a component of Red Hat Directory Server 12.4 E4S for RHEL 9",
"product_id": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12"
},
"product_reference": "389-ds-base-snmp-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64 (redhat-ds:12) as a component of Red Hat Directory Server 12.4 E4S for RHEL 9",
"product_id": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-389-ds-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch (redhat-ds:12) as a component of Red Hat Directory Server 12.4 E4S for RHEL 9",
"product_id": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:cockpit-389-ds-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12"
},
"product_reference": "cockpit-389-ds-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-lib389-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch (redhat-ds:12) as a component of Red Hat Directory Server 12.4 E4S for RHEL 9",
"product_id": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:python3-lib389-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12"
},
"product_reference": "python3-lib389-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11610",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-04-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484414"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server\n(389-ds-base). After a successful SASL bind with integrity protection (SSF \u003e 0),\nan authenticated attacker can send a specially crafted oversized LDAP UNBIND packet\nthat is copied into a 512-byte heap receive buffer without a bounds check in\nsasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of\nattacker-controlled data to overflow the buffer, causing a denial of service (server\ncrash). In FreeIPA and Red Hat Identity Management deployments, any domain user with\na valid Kerberos ticket, any enrolled host, or any service account can trigger this\nvulnerability over the network after authenticating via GSSAPI.\nThe vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and\nwas not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow\nin schema.c only.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important impact. After a successful SASL bind with integrity protection (SSF \u003e 0), an authenticated remote attacker can send a crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv(). Up to roughly two megabytes of attacker-controlled data can overflow the buffer, reliably crashing ns-slapd on production builds. Exploitation requires a valid SASL-authenticated LDAP session, not Directory Manager access. Any user who can bind with SASL mechanisms such as GSSAPI/Kerberos or DIGEST-MD5 can trigger the denial of service. In deployments where domain users, enrolled hosts, and service accounts routinely authenticate to the directory over Kerberos, the attack surface includes any such principal with network access to LDAP. This flaw is independent of CVE-2025-14905, which patched a separate heap overflow in schema.c and did not modify sasl_io.c.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.src::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debugsource-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-devel-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:cockpit-389-ds-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:python3-lib389-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11610"
},
{
"category": "external",
"summary": "RHBZ#2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11610"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610"
}
],
"release_date": "2026-07-07T09:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-07T12:32:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.src::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debugsource-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-devel-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:cockpit-389-ds-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:python3-lib389-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36209"
},
{
"category": "workaround",
"details": "There is no complete workaround for this flaw.\nMitigations that reduce exposure:\n1. Restrict network access to LDAP ports (389/636) to trusted networks only.\n Note: In FreeIPA/IdM deployments, enrolled clients require LDAP access and\n this may not be practical.\n2. If DIGEST-MD5 is not required, disable it via nsslapd-allowed-sasl-mechanisms\n in cn=config. GSSAPI/Kerberos cannot be disabled in FreeIPA/IdM without breaking\n domain authentication.\n3. Monitor for oversized LDAP UNBIND packets (standard UNBIND is 7 bytes; alert on\n UNBIND packets exceeding ~100 bytes).\n4. Lowering nsslapd-maxbersize reduces maximum overflow size but does not eliminate\n the vulnerability.",
"product_ids": [
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.src::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debugsource-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-devel-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:cockpit-389-ds-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:python3-lib389-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.src::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debugsource-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-devel-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:cockpit-389-ds-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:python3-lib389-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND"
},
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11774",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484916"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF \u003e 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important. After a successful SASL bind with integrity protection, an authenticated attacker can send a SASL-framed packet whose length prefix wraps when processed in sasl_io_start_packet(), bypassing nsslapd-maxsasliosize and causing a heap buffer overflow of up to approximately two megabytes of attacker-controlled data.\n\nThis flaw is independent of CVE-2025-14905 (schema.c). Any domain user with a Kerberos ticket can trigger it remotely after GSSAPI authentication. Red Hat assigns C:L/I:L rather than Critical because remote code execution on current platforms with glibc 2.32+ is blocked by tcache safe linking; RCE was demonstrated on RHEL 8 with glibc 2.28 but required a heap address leak. Denial of service is reliable on all platforms.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.src::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debugsource-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-devel-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:cockpit-389-ds-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:python3-lib389-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11774"
},
{
"category": "external",
"summary": "RHBZ#2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11774",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905"
}
],
"release_date": "2026-06-04T21:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-07T12:32:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.src::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debugsource-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-devel-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:cockpit-389-ds-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:python3-lib389-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36209"
},
{
"category": "workaround",
"details": "No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.",
"product_ids": [
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.src::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debugsource-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-devel-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:cockpit-389-ds-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:python3-lib389-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.src::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-debugsource-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-devel-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-libs-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:389-ds-base-snmp-debuginfo-0:2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:cockpit-389-ds-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12",
"BaseOS-9.4.0.Z.E4S-DirSrv-12.4-E4S:python3-lib389-0:2.4.5-24.module+el9dsrv+24459+87716c2d.noarch::redhat-ds:12"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow"
}
]
}
RHSA-2026:36585
Vulnerability from csaf_redhat - Published: 2026-07-08 06:34 - Updated: 2026-07-08 19:27Summary
Red Hat Security Advisory: 389-ds-base security update
Severity
Important
Notes
Topic: An update for 389-ds-base is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: 389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.
Security Fix(es):
* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)
* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.
8.8 (High)
Affected products
Fixed
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:python3-lib389-0:2.2.4-19.el9_2.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.
7.6 (High)
Affected products
Fixed
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:python3-lib389-0:2.2.4-19.el9_2.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
14 references
Acknowledgments
Red Hat
Ian Murphy
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for 389-ds-base is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.\n\nSecurity Fix(es):\n\n* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)\n\n* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:36585",
"url": "https://access.redhat.com/errata/RHSA-2026:36585"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36585.json"
}
],
"title": "Red Hat Security Advisory: 389-ds-base security update",
"tracking": {
"current_release_date": "2026-07-08T19:27:02+00:00",
"generator": {
"date": "2026-07-08T19:27:02+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:36585",
"initial_release_date": "2026-07-08T06:34:48+00:00",
"revision_history": [
{
"date": "2026-07-08T06:34:48+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-08T06:34:48+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-08T19:27:02+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product": {
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_e4s:9.2::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:2.2.4-19.el9_2.src",
"product": {
"name": "389-ds-base-0:2.2.4-19.el9_2.src",
"product_id": "389-ds-base-0:2.2.4-19.el9_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@2.2.4-19.el9_2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:2.2.4-19.el9_2.aarch64",
"product": {
"name": "389-ds-base-0:2.2.4-19.el9_2.aarch64",
"product_id": "389-ds-base-0:2.2.4-19.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@2.2.4-19.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:2.2.4-19.el9_2.aarch64",
"product": {
"name": "389-ds-base-libs-0:2.2.4-19.el9_2.aarch64",
"product_id": "389-ds-base-libs-0:2.2.4-19.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@2.2.4-19.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debugsource-0:2.2.4-19.el9_2.aarch64",
"product": {
"name": "389-ds-base-debugsource-0:2.2.4-19.el9_2.aarch64",
"product_id": "389-ds-base-debugsource-0:2.2.4-19.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debugsource@2.2.4-19.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.aarch64",
"product": {
"name": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.aarch64",
"product_id": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@2.2.4-19.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.aarch64",
"product": {
"name": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.aarch64",
"product_id": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@2.2.4-19.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.aarch64",
"product": {
"name": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.aarch64",
"product_id": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@2.2.4-19.el9_2?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:2.2.4-19.el9_2.ppc64le",
"product": {
"name": "389-ds-base-0:2.2.4-19.el9_2.ppc64le",
"product_id": "389-ds-base-0:2.2.4-19.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@2.2.4-19.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:2.2.4-19.el9_2.ppc64le",
"product": {
"name": "389-ds-base-libs-0:2.2.4-19.el9_2.ppc64le",
"product_id": "389-ds-base-libs-0:2.2.4-19.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@2.2.4-19.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debugsource-0:2.2.4-19.el9_2.ppc64le",
"product": {
"name": "389-ds-base-debugsource-0:2.2.4-19.el9_2.ppc64le",
"product_id": "389-ds-base-debugsource-0:2.2.4-19.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debugsource@2.2.4-19.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"product": {
"name": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"product_id": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@2.2.4-19.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"product": {
"name": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"product_id": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@2.2.4-19.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"product": {
"name": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"product_id": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@2.2.4-19.el9_2?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:2.2.4-19.el9_2.x86_64",
"product": {
"name": "389-ds-base-0:2.2.4-19.el9_2.x86_64",
"product_id": "389-ds-base-0:2.2.4-19.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@2.2.4-19.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:2.2.4-19.el9_2.x86_64",
"product": {
"name": "389-ds-base-libs-0:2.2.4-19.el9_2.x86_64",
"product_id": "389-ds-base-libs-0:2.2.4-19.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@2.2.4-19.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debugsource-0:2.2.4-19.el9_2.x86_64",
"product": {
"name": "389-ds-base-debugsource-0:2.2.4-19.el9_2.x86_64",
"product_id": "389-ds-base-debugsource-0:2.2.4-19.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debugsource@2.2.4-19.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.x86_64",
"product": {
"name": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.x86_64",
"product_id": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@2.2.4-19.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.x86_64",
"product": {
"name": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.x86_64",
"product_id": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@2.2.4-19.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.x86_64",
"product": {
"name": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.x86_64",
"product_id": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@2.2.4-19.el9_2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:2.2.4-19.el9_2.s390x",
"product": {
"name": "389-ds-base-0:2.2.4-19.el9_2.s390x",
"product_id": "389-ds-base-0:2.2.4-19.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@2.2.4-19.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:2.2.4-19.el9_2.s390x",
"product": {
"name": "389-ds-base-libs-0:2.2.4-19.el9_2.s390x",
"product_id": "389-ds-base-libs-0:2.2.4-19.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@2.2.4-19.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debugsource-0:2.2.4-19.el9_2.s390x",
"product": {
"name": "389-ds-base-debugsource-0:2.2.4-19.el9_2.s390x",
"product_id": "389-ds-base-debugsource-0:2.2.4-19.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debugsource@2.2.4-19.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.s390x",
"product": {
"name": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.s390x",
"product_id": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@2.2.4-19.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.s390x",
"product": {
"name": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.s390x",
"product_id": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@2.2.4-19.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.s390x",
"product": {
"name": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.s390x",
"product_id": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@2.2.4-19.el9_2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-lib389-0:2.2.4-19.el9_2.noarch",
"product": {
"name": "python3-lib389-0:2.2.4-19.el9_2.noarch",
"product_id": "python3-lib389-0:2.2.4-19.el9_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-lib389@2.2.4-19.el9_2?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:2.2.4-19.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.aarch64"
},
"product_reference": "389-ds-base-0:2.2.4-19.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:2.2.4-19.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.ppc64le"
},
"product_reference": "389-ds-base-0:2.2.4-19.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:2.2.4-19.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.s390x"
},
"product_reference": "389-ds-base-0:2.2.4-19.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:2.2.4-19.el9_2.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.src"
},
"product_reference": "389-ds-base-0:2.2.4-19.el9_2.src",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:2.2.4-19.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.x86_64"
},
"product_reference": "389-ds-base-0:2.2.4-19.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.aarch64"
},
"product_reference": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.ppc64le"
},
"product_reference": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.s390x"
},
"product_reference": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.x86_64"
},
"product_reference": "389-ds-base-debuginfo-0:2.2.4-19.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:2.2.4-19.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.aarch64"
},
"product_reference": "389-ds-base-debugsource-0:2.2.4-19.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:2.2.4-19.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.ppc64le"
},
"product_reference": "389-ds-base-debugsource-0:2.2.4-19.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:2.2.4-19.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.s390x"
},
"product_reference": "389-ds-base-debugsource-0:2.2.4-19.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:2.2.4-19.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.x86_64"
},
"product_reference": "389-ds-base-debugsource-0:2.2.4-19.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:2.2.4-19.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.aarch64"
},
"product_reference": "389-ds-base-libs-0:2.2.4-19.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:2.2.4-19.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.ppc64le"
},
"product_reference": "389-ds-base-libs-0:2.2.4-19.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:2.2.4-19.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.s390x"
},
"product_reference": "389-ds-base-libs-0:2.2.4-19.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:2.2.4-19.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.x86_64"
},
"product_reference": "389-ds-base-libs-0:2.2.4-19.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.aarch64"
},
"product_reference": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.ppc64le"
},
"product_reference": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.s390x"
},
"product_reference": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.x86_64"
},
"product_reference": "389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.aarch64"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.ppc64le"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.s390x"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.x86_64"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-lib389-0:2.2.4-19.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:python3-lib389-0:2.2.4-19.el9_2.noarch"
},
"product_reference": "python3-lib389-0:2.2.4-19.el9_2.noarch",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11610",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-04-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484414"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server\n(389-ds-base). After a successful SASL bind with integrity protection (SSF \u003e 0),\nan authenticated attacker can send a specially crafted oversized LDAP UNBIND packet\nthat is copied into a 512-byte heap receive buffer without a bounds check in\nsasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of\nattacker-controlled data to overflow the buffer, causing a denial of service (server\ncrash). In FreeIPA and Red Hat Identity Management deployments, any domain user with\na valid Kerberos ticket, any enrolled host, or any service account can trigger this\nvulnerability over the network after authenticating via GSSAPI.\nThe vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and\nwas not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow\nin schema.c only.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important impact. After a successful SASL bind with integrity protection (SSF \u003e 0), an authenticated remote attacker can send a crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv(). Up to roughly two megabytes of attacker-controlled data can overflow the buffer, reliably crashing ns-slapd on production builds. Exploitation requires a valid SASL-authenticated LDAP session, not Directory Manager access. Any user who can bind with SASL mechanisms such as GSSAPI/Kerberos or DIGEST-MD5 can trigger the denial of service. In deployments where domain users, enrolled hosts, and service accounts routinely authenticate to the directory over Kerberos, the attack surface includes any such principal with network access to LDAP. This flaw is independent of CVE-2025-14905, which patched a separate heap overflow in schema.c and did not modify sasl_io.c.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.src",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:python3-lib389-0:2.2.4-19.el9_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11610"
},
{
"category": "external",
"summary": "RHBZ#2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11610"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610"
}
],
"release_date": "2026-07-07T09:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T06:34:48+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.src",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:python3-lib389-0:2.2.4-19.el9_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36585"
},
{
"category": "workaround",
"details": "There is no complete workaround for this flaw.\nMitigations that reduce exposure:\n1. Restrict network access to LDAP ports (389/636) to trusted networks only.\n Note: In FreeIPA/IdM deployments, enrolled clients require LDAP access and\n this may not be practical.\n2. If DIGEST-MD5 is not required, disable it via nsslapd-allowed-sasl-mechanisms\n in cn=config. GSSAPI/Kerberos cannot be disabled in FreeIPA/IdM without breaking\n domain authentication.\n3. Monitor for oversized LDAP UNBIND packets (standard UNBIND is 7 bytes; alert on\n UNBIND packets exceeding ~100 bytes).\n4. Lowering nsslapd-maxbersize reduces maximum overflow size but does not eliminate\n the vulnerability.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.src",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:python3-lib389-0:2.2.4-19.el9_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.src",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:python3-lib389-0:2.2.4-19.el9_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND"
},
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11774",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484916"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF \u003e 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important. After a successful SASL bind with integrity protection, an authenticated attacker can send a SASL-framed packet whose length prefix wraps when processed in sasl_io_start_packet(), bypassing nsslapd-maxsasliosize and causing a heap buffer overflow of up to approximately two megabytes of attacker-controlled data.\n\nThis flaw is independent of CVE-2025-14905 (schema.c). Any domain user with a Kerberos ticket can trigger it remotely after GSSAPI authentication. Red Hat assigns C:L/I:L rather than Critical because remote code execution on current platforms with glibc 2.32+ is blocked by tcache safe linking; RCE was demonstrated on RHEL 8 with glibc 2.28 but required a heap address leak. Denial of service is reliable on all platforms.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.src",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:python3-lib389-0:2.2.4-19.el9_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11774"
},
{
"category": "external",
"summary": "RHBZ#2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11774",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905"
}
],
"release_date": "2026-06-04T21:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T06:34:48+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.src",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:python3-lib389-0:2.2.4-19.el9_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36585"
},
{
"category": "workaround",
"details": "No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.src",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:python3-lib389-0:2.2.4-19.el9_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.src",
"AppStream-9.2.0.Z.E4S:389-ds-base-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-debugsource-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-libs-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:389-ds-base-snmp-debuginfo-0:2.2.4-19.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:python3-lib389-0:2.2.4-19.el9_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow"
}
]
}
RHSA-2026:36641
Vulnerability from csaf_redhat - Published: 2026-07-08 09:26 - Updated: 2026-07-08 19:27Summary
Red Hat Security Advisory: redhat-ds:12 security update
Severity
Important
Notes
Topic: An update for the redhat-ds:12 module is now available for Red Hat Directory Server 12.2 E4S for RHEL 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages for server administration.
Security Fix(es):
* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)
* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.
8.8 (High)
Affected products
Fixed
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.src::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debugsource-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-devel-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:cockpit-389-ds-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:python3-lib389-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.
7.6 (High)
Affected products
Fixed
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.src::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debugsource-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-devel-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:cockpit-389-ds-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:python3-lib389-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
14 references
Acknowledgments
Red Hat
Ian Murphy
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for the redhat-ds:12 module is now available for Red Hat Directory Server 12.2 E4S for RHEL 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages for server administration.\n\nSecurity Fix(es):\n\n* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)\n\n* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:36641",
"url": "https://access.redhat.com/errata/RHSA-2026:36641"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36641.json"
}
],
"title": "Red Hat Security Advisory: redhat-ds:12 security update",
"tracking": {
"current_release_date": "2026-07-08T19:27:02+00:00",
"generator": {
"date": "2026-07-08T19:27:02+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:36641",
"initial_release_date": "2026-07-08T09:26:43+00:00",
"revision_history": [
{
"date": "2026-07-08T09:26:43+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-08T09:26:43+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-08T19:27:02+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Directory Server 12.2 E4S for RHEL 9",
"product": {
"name": "Red Hat Directory Server 12.2 E4S for RHEL 9",
"product_id": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:directory_server_e4s:12.2::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Directory Server"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.src::redhat-ds:12",
"product": {
"name": "389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.src (redhat-ds:12)",
"product_id": "389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.src::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@2.2.7-16.module%2Bel9dsrv%2B24460%2B990bd826?arch=src\u0026rpmmod=redhat-ds:12:9020020260703060155:1674d574"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"product": {
"name": "389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64 (redhat-ds:12)",
"product_id": "389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@2.2.7-16.module%2Bel9dsrv%2B24460%2B990bd826?arch=x86_64\u0026rpmmod=redhat-ds:12:9020020260703060155:1674d574"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"product": {
"name": "389-ds-base-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64 (redhat-ds:12)",
"product_id": "389-ds-base-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@2.2.7-16.module%2Bel9dsrv%2B24460%2B990bd826?arch=x86_64\u0026rpmmod=redhat-ds:12:9020020260703060155:1674d574"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debugsource-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"product": {
"name": "389-ds-base-debugsource-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64 (redhat-ds:12)",
"product_id": "389-ds-base-debugsource-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debugsource@2.2.7-16.module%2Bel9dsrv%2B24460%2B990bd826?arch=x86_64\u0026rpmmod=redhat-ds:12:9020020260703060155:1674d574"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-devel-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"product": {
"name": "389-ds-base-devel-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64 (redhat-ds:12)",
"product_id": "389-ds-base-devel-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-devel@2.2.7-16.module%2Bel9dsrv%2B24460%2B990bd826?arch=x86_64\u0026rpmmod=redhat-ds:12:9020020260703060155:1674d574"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"product": {
"name": "389-ds-base-libs-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64 (redhat-ds:12)",
"product_id": "389-ds-base-libs-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@2.2.7-16.module%2Bel9dsrv%2B24460%2B990bd826?arch=x86_64\u0026rpmmod=redhat-ds:12:9020020260703060155:1674d574"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"product": {
"name": "389-ds-base-libs-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64 (redhat-ds:12)",
"product_id": "389-ds-base-libs-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@2.2.7-16.module%2Bel9dsrv%2B24460%2B990bd826?arch=x86_64\u0026rpmmod=redhat-ds:12:9020020260703060155:1674d574"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"product": {
"name": "389-ds-base-snmp-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64 (redhat-ds:12)",
"product_id": "389-ds-base-snmp-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp@2.2.7-16.module%2Bel9dsrv%2B24460%2B990bd826?arch=x86_64\u0026rpmmod=redhat-ds:12:9020020260703060155:1674d574"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"product": {
"name": "389-ds-base-snmp-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64 (redhat-ds:12)",
"product_id": "389-ds-base-snmp-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@2.2.7-16.module%2Bel9dsrv%2B24460%2B990bd826?arch=x86_64\u0026rpmmod=redhat-ds:12:9020020260703060155:1674d574"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "cockpit-389-ds-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12",
"product": {
"name": "cockpit-389-ds-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch (redhat-ds:12)",
"product_id": "cockpit-389-ds-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-389-ds@2.2.7-16.module%2Bel9dsrv%2B24460%2B990bd826?arch=noarch\u0026rpmmod=redhat-ds:12:9020020260703060155:1674d574"
}
}
},
{
"category": "product_version",
"name": "python3-lib389-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12",
"product": {
"name": "python3-lib389-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch (redhat-ds:12)",
"product_id": "python3-lib389-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-lib389@2.2.7-16.module%2Bel9dsrv%2B24460%2B990bd826?arch=noarch\u0026rpmmod=redhat-ds:12:9020020260703060155:1674d574"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.src (redhat-ds:12) as a component of Red Hat Directory Server 12.2 E4S for RHEL 9",
"product_id": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.src::redhat-ds:12"
},
"product_reference": "389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.src::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64 (redhat-ds:12) as a component of Red Hat Directory Server 12.2 E4S for RHEL 9",
"product_id": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12"
},
"product_reference": "389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64 (redhat-ds:12) as a component of Red Hat Directory Server 12.2 E4S for RHEL 9",
"product_id": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12"
},
"product_reference": "389-ds-base-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64 (redhat-ds:12) as a component of Red Hat Directory Server 12.2 E4S for RHEL 9",
"product_id": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debugsource-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12"
},
"product_reference": "389-ds-base-debugsource-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64 (redhat-ds:12) as a component of Red Hat Directory Server 12.2 E4S for RHEL 9",
"product_id": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-devel-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12"
},
"product_reference": "389-ds-base-devel-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64 (redhat-ds:12) as a component of Red Hat Directory Server 12.2 E4S for RHEL 9",
"product_id": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12"
},
"product_reference": "389-ds-base-libs-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64 (redhat-ds:12) as a component of Red Hat Directory Server 12.2 E4S for RHEL 9",
"product_id": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12"
},
"product_reference": "389-ds-base-libs-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64 (redhat-ds:12) as a component of Red Hat Directory Server 12.2 E4S for RHEL 9",
"product_id": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12"
},
"product_reference": "389-ds-base-snmp-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64 (redhat-ds:12) as a component of Red Hat Directory Server 12.2 E4S for RHEL 9",
"product_id": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-389-ds-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch (redhat-ds:12) as a component of Red Hat Directory Server 12.2 E4S for RHEL 9",
"product_id": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:cockpit-389-ds-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12"
},
"product_reference": "cockpit-389-ds-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-lib389-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch (redhat-ds:12) as a component of Red Hat Directory Server 12.2 E4S for RHEL 9",
"product_id": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:python3-lib389-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12"
},
"product_reference": "python3-lib389-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12",
"relates_to_product_reference": "BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11610",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-04-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484414"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server\n(389-ds-base). After a successful SASL bind with integrity protection (SSF \u003e 0),\nan authenticated attacker can send a specially crafted oversized LDAP UNBIND packet\nthat is copied into a 512-byte heap receive buffer without a bounds check in\nsasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of\nattacker-controlled data to overflow the buffer, causing a denial of service (server\ncrash). In FreeIPA and Red Hat Identity Management deployments, any domain user with\na valid Kerberos ticket, any enrolled host, or any service account can trigger this\nvulnerability over the network after authenticating via GSSAPI.\nThe vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and\nwas not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow\nin schema.c only.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important impact. After a successful SASL bind with integrity protection (SSF \u003e 0), an authenticated remote attacker can send a crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv(). Up to roughly two megabytes of attacker-controlled data can overflow the buffer, reliably crashing ns-slapd on production builds. Exploitation requires a valid SASL-authenticated LDAP session, not Directory Manager access. Any user who can bind with SASL mechanisms such as GSSAPI/Kerberos or DIGEST-MD5 can trigger the denial of service. In deployments where domain users, enrolled hosts, and service accounts routinely authenticate to the directory over Kerberos, the attack surface includes any such principal with network access to LDAP. This flaw is independent of CVE-2025-14905, which patched a separate heap overflow in schema.c and did not modify sasl_io.c.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.src::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debugsource-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-devel-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:cockpit-389-ds-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:python3-lib389-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11610"
},
{
"category": "external",
"summary": "RHBZ#2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11610"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610"
}
],
"release_date": "2026-07-07T09:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T09:26:43+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.src::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debugsource-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-devel-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:cockpit-389-ds-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:python3-lib389-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36641"
},
{
"category": "workaround",
"details": "There is no complete workaround for this flaw.\nMitigations that reduce exposure:\n1. Restrict network access to LDAP ports (389/636) to trusted networks only.\n Note: In FreeIPA/IdM deployments, enrolled clients require LDAP access and\n this may not be practical.\n2. If DIGEST-MD5 is not required, disable it via nsslapd-allowed-sasl-mechanisms\n in cn=config. GSSAPI/Kerberos cannot be disabled in FreeIPA/IdM without breaking\n domain authentication.\n3. Monitor for oversized LDAP UNBIND packets (standard UNBIND is 7 bytes; alert on\n UNBIND packets exceeding ~100 bytes).\n4. Lowering nsslapd-maxbersize reduces maximum overflow size but does not eliminate\n the vulnerability.",
"product_ids": [
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.src::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debugsource-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-devel-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:cockpit-389-ds-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:python3-lib389-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.src::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debugsource-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-devel-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:cockpit-389-ds-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:python3-lib389-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND"
},
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11774",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484916"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF \u003e 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important. After a successful SASL bind with integrity protection, an authenticated attacker can send a SASL-framed packet whose length prefix wraps when processed in sasl_io_start_packet(), bypassing nsslapd-maxsasliosize and causing a heap buffer overflow of up to approximately two megabytes of attacker-controlled data.\n\nThis flaw is independent of CVE-2025-14905 (schema.c). Any domain user with a Kerberos ticket can trigger it remotely after GSSAPI authentication. Red Hat assigns C:L/I:L rather than Critical because remote code execution on current platforms with glibc 2.32+ is blocked by tcache safe linking; RCE was demonstrated on RHEL 8 with glibc 2.28 but required a heap address leak. Denial of service is reliable on all platforms.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.src::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debugsource-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-devel-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:cockpit-389-ds-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:python3-lib389-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11774"
},
{
"category": "external",
"summary": "RHBZ#2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11774",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905"
}
],
"release_date": "2026-06-04T21:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T09:26:43+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.src::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debugsource-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-devel-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:cockpit-389-ds-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:python3-lib389-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36641"
},
{
"category": "workaround",
"details": "No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.",
"product_ids": [
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.src::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debugsource-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-devel-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:cockpit-389-ds-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:python3-lib389-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.src::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-debugsource-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-devel-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-libs-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:389-ds-base-snmp-debuginfo-0:2.2.7-16.module+el9dsrv+24460+990bd826.x86_64::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:cockpit-389-ds-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12",
"BaseOS-9.2.0.Z.E4S-DirSrv-12.2-E4S:python3-lib389-0:2.2.7-16.module+el9dsrv+24460+990bd826.noarch::redhat-ds:12"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow"
}
]
}
RHSA-2026:36660
Vulnerability from csaf_redhat - Published: 2026-07-08 10:38 - Updated: 2026-07-08 13:04Summary
Red Hat Security Advisory: Red Hat Directory Server 13.2 container image update
Severity
Important
Notes
Topic: An updated Red Hat Directory Server 13.2 container image for RHEL 10 is now available in the Red Hat container registry, including bug fixes and security patches.
Details: Red Hat Directory Server is an LDAPv3-compliant directory server. The image is maintained by Red Hat and updated regularly.
To pull this container image, run the following command: podman pull registry.redhat.io/dirsrv/dirsrv-container-rhel10:13.2
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.
7.6 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
16 references
Acknowledgments
Red Hat
Ian Murphy
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated Red Hat Directory Server 13.2 container image for RHEL 10 is now available in the Red Hat container registry, including bug fixes and security patches.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Directory Server is an LDAPv3-compliant directory server. The image is maintained by Red Hat and updated regularly.\nTo pull this container image, run the following command: podman pull registry.redhat.io/dirsrv/dirsrv-container-rhel10:13.2",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:36660",
"url": "https://access.redhat.com/errata/RHSA-2026:36660"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-11610",
"url": "https://access.redhat.com/security/cve/CVE-2026-11610"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-11774",
"url": "https://access.redhat.com/security/cve/CVE-2026-11774"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://catalog.redhat.com/software/containers/search",
"url": "https://catalog.redhat.com/software/containers/search"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_directory_server/13/html/red_hat_directory_server_13_release_notes/index",
"url": "https://docs.redhat.com/en/documentation/red_hat_directory_server/13/html/red_hat_directory_server_13_release_notes/index"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36660.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Directory Server 13.2 container image update",
"tracking": {
"current_release_date": "2026-07-08T13:04:45+00:00",
"generator": {
"date": "2026-07-08T13:04:45+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:36660",
"initial_release_date": "2026-07-08T10:38:06+00:00",
"revision_history": [
{
"date": "2026-07-08T10:38:06+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-08T10:38:08+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-08T13:04:45+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Directory Server 13.2",
"product": {
"name": "Red Hat Directory Server 13.2",
"product_id": "Red Hat Directory Server 13.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:directory_server:13.2::el10"
}
}
}
],
"category": "product_family",
"name": "Red Hat Directory Server"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64",
"product": {
"name": "registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64",
"product_id": "registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64",
"product_identification_helper": {
"purl": "pkg:oci/dirsrv-container-rhel10@sha256%3Aaa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3?arch=amd64\u0026repository_url=registry.redhat.io/dirsrv/dirsrv-container-rhel10\u0026tag=1783452100"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64 as a component of Red Hat Directory Server 13.2",
"product_id": "Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
},
"product_reference": "registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64",
"relates_to_product_reference": "Red Hat Directory Server 13.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11610",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-04-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484414"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server\n(389-ds-base). After a successful SASL bind with integrity protection (SSF \u003e 0),\nan authenticated attacker can send a specially crafted oversized LDAP UNBIND packet\nthat is copied into a 512-byte heap receive buffer without a bounds check in\nsasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of\nattacker-controlled data to overflow the buffer, causing a denial of service (server\ncrash). In FreeIPA and Red Hat Identity Management deployments, any domain user with\na valid Kerberos ticket, any enrolled host, or any service account can trigger this\nvulnerability over the network after authenticating via GSSAPI.\nThe vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and\nwas not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow\nin schema.c only.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important impact. After a successful SASL bind with integrity protection (SSF \u003e 0), an authenticated remote attacker can send a crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv(). Up to roughly two megabytes of attacker-controlled data can overflow the buffer, reliably crashing ns-slapd on production builds. Exploitation requires a valid SASL-authenticated LDAP session, not Directory Manager access. Any user who can bind with SASL mechanisms such as GSSAPI/Kerberos or DIGEST-MD5 can trigger the denial of service. In deployments where domain users, enrolled hosts, and service accounts routinely authenticate to the directory over Kerberos, the attack surface includes any such principal with network access to LDAP. This flaw is independent of CVE-2025-14905, which patched a separate heap overflow in schema.c and did not modify sasl_io.c.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11610"
},
{
"category": "external",
"summary": "RHBZ#2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11610"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610"
}
],
"release_date": "2026-07-07T09:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T10:38:06+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command. For more information about the image, search the \u003cimage_name\u003e in the Red Hat Ecosystem Catalog: https://catalog.redhat.com/software/containers/search",
"product_ids": [
"Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36660"
},
{
"category": "workaround",
"details": "There is no complete workaround for this flaw.\nMitigations that reduce exposure:\n1. Restrict network access to LDAP ports (389/636) to trusted networks only.\n Note: In FreeIPA/IdM deployments, enrolled clients require LDAP access and\n this may not be practical.\n2. If DIGEST-MD5 is not required, disable it via nsslapd-allowed-sasl-mechanisms\n in cn=config. GSSAPI/Kerberos cannot be disabled in FreeIPA/IdM without breaking\n domain authentication.\n3. Monitor for oversized LDAP UNBIND packets (standard UNBIND is 7 bytes; alert on\n UNBIND packets exceeding ~100 bytes).\n4. Lowering nsslapd-maxbersize reduces maximum overflow size but does not eliminate\n the vulnerability.",
"product_ids": [
"Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND"
},
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11774",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484916"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF \u003e 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important. After a successful SASL bind with integrity protection, an authenticated attacker can send a SASL-framed packet whose length prefix wraps when processed in sasl_io_start_packet(), bypassing nsslapd-maxsasliosize and causing a heap buffer overflow of up to approximately two megabytes of attacker-controlled data.\n\nThis flaw is independent of CVE-2025-14905 (schema.c). Any domain user with a Kerberos ticket can trigger it remotely after GSSAPI authentication. Red Hat assigns C:L/I:L rather than Critical because remote code execution on current platforms with glibc 2.32+ is blocked by tcache safe linking; RCE was demonstrated on RHEL 8 with glibc 2.28 but required a heap address leak. Denial of service is reliable on all platforms.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11774"
},
{
"category": "external",
"summary": "RHBZ#2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11774",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905"
}
],
"release_date": "2026-06-04T21:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T10:38:06+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command. For more information about the image, search the \u003cimage_name\u003e in the Red Hat Ecosystem Catalog: https://catalog.redhat.com/software/containers/search",
"product_ids": [
"Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36660"
},
{
"category": "workaround",
"details": "No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.",
"product_ids": [
"Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow"
}
]
}
RHSA-2026:36670
Vulnerability from csaf_redhat - Published: 2026-07-08 11:36 - Updated: 2026-07-08 19:26Summary
Red Hat Security Advisory: 389-ds-base security update
Severity
Important
Notes
Topic: An update for 389-ds-base is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: 389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.
Security Fix(es):
* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)
* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.
8.8 (High)
Affected products
Fixed
62 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:python3-lib389-0:3.0.6-19.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.
7.6 (High)
Affected products
Fixed
62 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:python3-lib389-0:3.0.6-19.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
14 references
Acknowledgments
Red Hat
Ian Murphy
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for 389-ds-base is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.\n\nSecurity Fix(es):\n\n* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)\n\n* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:36670",
"url": "https://access.redhat.com/errata/RHSA-2026:36670"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36670.json"
}
],
"title": "Red Hat Security Advisory: 389-ds-base security update",
"tracking": {
"current_release_date": "2026-07-08T19:26:49+00:00",
"generator": {
"date": "2026-07-08T19:26:49+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:36670",
"initial_release_date": "2026-07-08T11:36:33+00:00",
"revision_history": [
{
"date": "2026-07-08T11:36:33+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-08T11:36:33+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-08T19:26:49+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product": {
"name": "Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:3.0.6-19.el10_0.src",
"product": {
"name": "389-ds-base-0:3.0.6-19.el10_0.src",
"product_id": "389-ds-base-0:3.0.6-19.el10_0.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@3.0.6-19.el10_0?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:3.0.6-19.el10_0.aarch64",
"product": {
"name": "389-ds-base-0:3.0.6-19.el10_0.aarch64",
"product_id": "389-ds-base-0:3.0.6-19.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@3.0.6-19.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:3.0.6-19.el10_0.aarch64",
"product": {
"name": "389-ds-base-libs-0:3.0.6-19.el10_0.aarch64",
"product_id": "389-ds-base-libs-0:3.0.6-19.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@3.0.6-19.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-0:3.0.6-19.el10_0.aarch64",
"product": {
"name": "389-ds-base-snmp-0:3.0.6-19.el10_0.aarch64",
"product_id": "389-ds-base-snmp-0:3.0.6-19.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp@3.0.6-19.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"product": {
"name": "389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"product_id": "389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debugsource@3.0.6-19.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"product": {
"name": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"product_id": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-bdb-debuginfo@3.0.6-19.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"product": {
"name": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"product_id": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@3.0.6-19.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"product": {
"name": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"product_id": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@3.0.6-19.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"product": {
"name": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"product_id": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@3.0.6-19.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-bdb-0:3.0.6-19.el10_0.aarch64",
"product": {
"name": "389-ds-base-bdb-0:3.0.6-19.el10_0.aarch64",
"product_id": "389-ds-base-bdb-0:3.0.6-19.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-bdb@3.0.6-19.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-devel-0:3.0.6-19.el10_0.aarch64",
"product": {
"name": "389-ds-base-devel-0:3.0.6-19.el10_0.aarch64",
"product_id": "389-ds-base-devel-0:3.0.6-19.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-devel@3.0.6-19.el10_0?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:3.0.6-19.el10_0.ppc64le",
"product": {
"name": "389-ds-base-0:3.0.6-19.el10_0.ppc64le",
"product_id": "389-ds-base-0:3.0.6-19.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@3.0.6-19.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:3.0.6-19.el10_0.ppc64le",
"product": {
"name": "389-ds-base-libs-0:3.0.6-19.el10_0.ppc64le",
"product_id": "389-ds-base-libs-0:3.0.6-19.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@3.0.6-19.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-0:3.0.6-19.el10_0.ppc64le",
"product": {
"name": "389-ds-base-snmp-0:3.0.6-19.el10_0.ppc64le",
"product_id": "389-ds-base-snmp-0:3.0.6-19.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp@3.0.6-19.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"product": {
"name": "389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"product_id": "389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debugsource@3.0.6-19.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"product": {
"name": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"product_id": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-bdb-debuginfo@3.0.6-19.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"product": {
"name": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"product_id": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@3.0.6-19.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"product": {
"name": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"product_id": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@3.0.6-19.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"product": {
"name": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"product_id": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@3.0.6-19.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-bdb-0:3.0.6-19.el10_0.ppc64le",
"product": {
"name": "389-ds-base-bdb-0:3.0.6-19.el10_0.ppc64le",
"product_id": "389-ds-base-bdb-0:3.0.6-19.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-bdb@3.0.6-19.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-devel-0:3.0.6-19.el10_0.ppc64le",
"product": {
"name": "389-ds-base-devel-0:3.0.6-19.el10_0.ppc64le",
"product_id": "389-ds-base-devel-0:3.0.6-19.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-devel@3.0.6-19.el10_0?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:3.0.6-19.el10_0.x86_64",
"product": {
"name": "389-ds-base-0:3.0.6-19.el10_0.x86_64",
"product_id": "389-ds-base-0:3.0.6-19.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@3.0.6-19.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:3.0.6-19.el10_0.x86_64",
"product": {
"name": "389-ds-base-libs-0:3.0.6-19.el10_0.x86_64",
"product_id": "389-ds-base-libs-0:3.0.6-19.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@3.0.6-19.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-0:3.0.6-19.el10_0.x86_64",
"product": {
"name": "389-ds-base-snmp-0:3.0.6-19.el10_0.x86_64",
"product_id": "389-ds-base-snmp-0:3.0.6-19.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp@3.0.6-19.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"product": {
"name": "389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"product_id": "389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debugsource@3.0.6-19.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"product": {
"name": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"product_id": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-bdb-debuginfo@3.0.6-19.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"product": {
"name": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"product_id": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@3.0.6-19.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"product": {
"name": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"product_id": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@3.0.6-19.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64",
"product": {
"name": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64",
"product_id": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@3.0.6-19.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-bdb-0:3.0.6-19.el10_0.x86_64",
"product": {
"name": "389-ds-base-bdb-0:3.0.6-19.el10_0.x86_64",
"product_id": "389-ds-base-bdb-0:3.0.6-19.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-bdb@3.0.6-19.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-devel-0:3.0.6-19.el10_0.x86_64",
"product": {
"name": "389-ds-base-devel-0:3.0.6-19.el10_0.x86_64",
"product_id": "389-ds-base-devel-0:3.0.6-19.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-devel@3.0.6-19.el10_0?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:3.0.6-19.el10_0.s390x",
"product": {
"name": "389-ds-base-0:3.0.6-19.el10_0.s390x",
"product_id": "389-ds-base-0:3.0.6-19.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@3.0.6-19.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:3.0.6-19.el10_0.s390x",
"product": {
"name": "389-ds-base-libs-0:3.0.6-19.el10_0.s390x",
"product_id": "389-ds-base-libs-0:3.0.6-19.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@3.0.6-19.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-0:3.0.6-19.el10_0.s390x",
"product": {
"name": "389-ds-base-snmp-0:3.0.6-19.el10_0.s390x",
"product_id": "389-ds-base-snmp-0:3.0.6-19.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp@3.0.6-19.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"product": {
"name": "389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"product_id": "389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debugsource@3.0.6-19.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"product": {
"name": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"product_id": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-bdb-debuginfo@3.0.6-19.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"product": {
"name": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"product_id": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@3.0.6-19.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"product": {
"name": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"product_id": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@3.0.6-19.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"product": {
"name": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"product_id": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@3.0.6-19.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-bdb-0:3.0.6-19.el10_0.s390x",
"product": {
"name": "389-ds-base-bdb-0:3.0.6-19.el10_0.s390x",
"product_id": "389-ds-base-bdb-0:3.0.6-19.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-bdb@3.0.6-19.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-devel-0:3.0.6-19.el10_0.s390x",
"product": {
"name": "389-ds-base-devel-0:3.0.6-19.el10_0.s390x",
"product_id": "389-ds-base-devel-0:3.0.6-19.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-devel@3.0.6-19.el10_0?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-lib389-0:3.0.6-19.el10_0.noarch",
"product": {
"name": "python3-lib389-0:3.0.6-19.el10_0.noarch",
"product_id": "python3-lib389-0:3.0.6-19.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-lib389@3.0.6-19.el10_0?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:3.0.6-19.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.aarch64"
},
"product_reference": "389-ds-base-0:3.0.6-19.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:3.0.6-19.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.ppc64le"
},
"product_reference": "389-ds-base-0:3.0.6-19.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:3.0.6-19.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.s390x"
},
"product_reference": "389-ds-base-0:3.0.6-19.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:3.0.6-19.el10_0.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.src"
},
"product_reference": "389-ds-base-0:3.0.6-19.el10_0.src",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:3.0.6-19.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.x86_64"
},
"product_reference": "389-ds-base-0:3.0.6-19.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64"
},
"product_reference": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le"
},
"product_reference": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x"
},
"product_reference": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64"
},
"product_reference": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64"
},
"product_reference": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le"
},
"product_reference": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x"
},
"product_reference": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64"
},
"product_reference": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64"
},
"product_reference": "389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le"
},
"product_reference": "389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x"
},
"product_reference": "389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64"
},
"product_reference": "389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:3.0.6-19.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.aarch64"
},
"product_reference": "389-ds-base-libs-0:3.0.6-19.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:3.0.6-19.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.ppc64le"
},
"product_reference": "389-ds-base-libs-0:3.0.6-19.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:3.0.6-19.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.s390x"
},
"product_reference": "389-ds-base-libs-0:3.0.6-19.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:3.0.6-19.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.x86_64"
},
"product_reference": "389-ds-base-libs-0:3.0.6-19.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64"
},
"product_reference": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le"
},
"product_reference": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x"
},
"product_reference": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64"
},
"product_reference": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:3.0.6-19.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.aarch64"
},
"product_reference": "389-ds-base-snmp-0:3.0.6-19.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:3.0.6-19.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.ppc64le"
},
"product_reference": "389-ds-base-snmp-0:3.0.6-19.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:3.0.6-19.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.s390x"
},
"product_reference": "389-ds-base-snmp-0:3.0.6-19.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:3.0.6-19.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.x86_64"
},
"product_reference": "389-ds-base-snmp-0:3.0.6-19.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-lib389-0:3.0.6-19.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:python3-lib389-0:3.0.6-19.el10_0.noarch"
},
"product_reference": "python3-lib389-0:3.0.6-19.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-bdb-0:3.0.6-19.el10_0.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.aarch64"
},
"product_reference": "389-ds-base-bdb-0:3.0.6-19.el10_0.aarch64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-bdb-0:3.0.6-19.el10_0.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.ppc64le"
},
"product_reference": "389-ds-base-bdb-0:3.0.6-19.el10_0.ppc64le",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-bdb-0:3.0.6-19.el10_0.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.s390x"
},
"product_reference": "389-ds-base-bdb-0:3.0.6-19.el10_0.s390x",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-bdb-0:3.0.6-19.el10_0.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.x86_64"
},
"product_reference": "389-ds-base-bdb-0:3.0.6-19.el10_0.x86_64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64"
},
"product_reference": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le"
},
"product_reference": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x"
},
"product_reference": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64"
},
"product_reference": "389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64"
},
"product_reference": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le"
},
"product_reference": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x"
},
"product_reference": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64"
},
"product_reference": "389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64"
},
"product_reference": "389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le"
},
"product_reference": "389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x"
},
"product_reference": "389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64"
},
"product_reference": "389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:3.0.6-19.el10_0.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.aarch64"
},
"product_reference": "389-ds-base-devel-0:3.0.6-19.el10_0.aarch64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:3.0.6-19.el10_0.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.ppc64le"
},
"product_reference": "389-ds-base-devel-0:3.0.6-19.el10_0.ppc64le",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:3.0.6-19.el10_0.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.s390x"
},
"product_reference": "389-ds-base-devel-0:3.0.6-19.el10_0.s390x",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:3.0.6-19.el10_0.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.x86_64"
},
"product_reference": "389-ds-base-devel-0:3.0.6-19.el10_0.x86_64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64"
},
"product_reference": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le"
},
"product_reference": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x"
},
"product_reference": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64"
},
"product_reference": "389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11610",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-04-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484414"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server\n(389-ds-base). After a successful SASL bind with integrity protection (SSF \u003e 0),\nan authenticated attacker can send a specially crafted oversized LDAP UNBIND packet\nthat is copied into a 512-byte heap receive buffer without a bounds check in\nsasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of\nattacker-controlled data to overflow the buffer, causing a denial of service (server\ncrash). In FreeIPA and Red Hat Identity Management deployments, any domain user with\na valid Kerberos ticket, any enrolled host, or any service account can trigger this\nvulnerability over the network after authenticating via GSSAPI.\nThe vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and\nwas not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow\nin schema.c only.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important impact. After a successful SASL bind with integrity protection (SSF \u003e 0), an authenticated remote attacker can send a crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv(). Up to roughly two megabytes of attacker-controlled data can overflow the buffer, reliably crashing ns-slapd on production builds. Exploitation requires a valid SASL-authenticated LDAP session, not Directory Manager access. Any user who can bind with SASL mechanisms such as GSSAPI/Kerberos or DIGEST-MD5 can trigger the denial of service. In deployments where domain users, enrolled hosts, and service accounts routinely authenticate to the directory over Kerberos, the attack surface includes any such principal with network access to LDAP. This flaw is independent of CVE-2025-14905, which patched a separate heap overflow in schema.c and did not modify sasl_io.c.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.src",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:python3-lib389-0:3.0.6-19.el10_0.noarch",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11610"
},
{
"category": "external",
"summary": "RHBZ#2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11610"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610"
}
],
"release_date": "2026-07-07T09:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T11:36:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.src",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:python3-lib389-0:3.0.6-19.el10_0.noarch",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36670"
},
{
"category": "workaround",
"details": "There is no complete workaround for this flaw.\nMitigations that reduce exposure:\n1. Restrict network access to LDAP ports (389/636) to trusted networks only.\n Note: In FreeIPA/IdM deployments, enrolled clients require LDAP access and\n this may not be practical.\n2. If DIGEST-MD5 is not required, disable it via nsslapd-allowed-sasl-mechanisms\n in cn=config. GSSAPI/Kerberos cannot be disabled in FreeIPA/IdM without breaking\n domain authentication.\n3. Monitor for oversized LDAP UNBIND packets (standard UNBIND is 7 bytes; alert on\n UNBIND packets exceeding ~100 bytes).\n4. Lowering nsslapd-maxbersize reduces maximum overflow size but does not eliminate\n the vulnerability.",
"product_ids": [
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.src",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:python3-lib389-0:3.0.6-19.el10_0.noarch",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.src",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:python3-lib389-0:3.0.6-19.el10_0.noarch",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND"
},
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11774",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484916"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF \u003e 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important. After a successful SASL bind with integrity protection, an authenticated attacker can send a SASL-framed packet whose length prefix wraps when processed in sasl_io_start_packet(), bypassing nsslapd-maxsasliosize and causing a heap buffer overflow of up to approximately two megabytes of attacker-controlled data.\n\nThis flaw is independent of CVE-2025-14905 (schema.c). Any domain user with a Kerberos ticket can trigger it remotely after GSSAPI authentication. Red Hat assigns C:L/I:L rather than Critical because remote code execution on current platforms with glibc 2.32+ is blocked by tcache safe linking; RCE was demonstrated on RHEL 8 with glibc 2.28 but required a heap address leak. Denial of service is reliable on all platforms.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.src",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:python3-lib389-0:3.0.6-19.el10_0.noarch",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11774"
},
{
"category": "external",
"summary": "RHBZ#2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11774",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905"
}
],
"release_date": "2026-06-04T21:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T11:36:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.src",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:python3-lib389-0:3.0.6-19.el10_0.noarch",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36670"
},
{
"category": "workaround",
"details": "No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.",
"product_ids": [
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.src",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:python3-lib389-0:3.0.6-19.el10_0.noarch",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.src",
"AppStream-10.0.Z.E2S:389-ds-base-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-libs-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"AppStream-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64",
"AppStream-10.0.Z.E2S:python3-lib389-0:3.0.6-19.el10_0.noarch",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-bdb-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-bdb-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-debugsource-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-devel-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-libs-debuginfo-0:3.0.6-19.el10_0.x86_64",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.aarch64",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.ppc64le",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.s390x",
"CRB-10.0.Z.E2S:389-ds-base-snmp-debuginfo-0:3.0.6-19.el10_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow"
}
]
}
RHSA-2026:36671
Vulnerability from csaf_redhat - Published: 2026-07-08 12:25 - Updated: 2026-07-08 19:26Summary
Red Hat Security Advisory: 389-ds-base security update
Severity
Important
Notes
Topic: An update for 389-ds-base is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: 389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.
Security Fix(es):
* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)
* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.
8.8 (High)
Affected products
Fixed
50 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:python3-lib389-0:2.6.1-22.el9_6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.
7.6 (High)
Affected products
Fixed
50 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:python3-lib389-0:2.6.1-22.el9_6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
14 references
Acknowledgments
Red Hat
Ian Murphy
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for 389-ds-base is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.\n\nSecurity Fix(es):\n\n* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)\n\n* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:36671",
"url": "https://access.redhat.com/errata/RHSA-2026:36671"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36671.json"
}
],
"title": "Red Hat Security Advisory: 389-ds-base security update",
"tracking": {
"current_release_date": "2026-07-08T19:26:49+00:00",
"generator": {
"date": "2026-07-08T19:26:49+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:36671",
"initial_release_date": "2026-07-08T12:25:23+00:00",
"revision_history": [
{
"date": "2026-07-08T12:25:23+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-08T12:25:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-08T19:26:49+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus:9.6::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product": {
"name": "Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus:9.6::crb"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:2.6.1-22.el9_6.src",
"product": {
"name": "389-ds-base-0:2.6.1-22.el9_6.src",
"product_id": "389-ds-base-0:2.6.1-22.el9_6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@2.6.1-22.el9_6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:2.6.1-22.el9_6.aarch64",
"product": {
"name": "389-ds-base-0:2.6.1-22.el9_6.aarch64",
"product_id": "389-ds-base-0:2.6.1-22.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@2.6.1-22.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:2.6.1-22.el9_6.aarch64",
"product": {
"name": "389-ds-base-libs-0:2.6.1-22.el9_6.aarch64",
"product_id": "389-ds-base-libs-0:2.6.1-22.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@2.6.1-22.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-0:2.6.1-22.el9_6.aarch64",
"product": {
"name": "389-ds-base-snmp-0:2.6.1-22.el9_6.aarch64",
"product_id": "389-ds-base-snmp-0:2.6.1-22.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp@2.6.1-22.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"product": {
"name": "389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"product_id": "389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debugsource@2.6.1-22.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"product": {
"name": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"product_id": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@2.6.1-22.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"product": {
"name": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"product_id": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@2.6.1-22.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"product": {
"name": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"product_id": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@2.6.1-22.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-devel-0:2.6.1-22.el9_6.aarch64",
"product": {
"name": "389-ds-base-devel-0:2.6.1-22.el9_6.aarch64",
"product_id": "389-ds-base-devel-0:2.6.1-22.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-devel@2.6.1-22.el9_6?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:2.6.1-22.el9_6.ppc64le",
"product": {
"name": "389-ds-base-0:2.6.1-22.el9_6.ppc64le",
"product_id": "389-ds-base-0:2.6.1-22.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@2.6.1-22.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:2.6.1-22.el9_6.ppc64le",
"product": {
"name": "389-ds-base-libs-0:2.6.1-22.el9_6.ppc64le",
"product_id": "389-ds-base-libs-0:2.6.1-22.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@2.6.1-22.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-0:2.6.1-22.el9_6.ppc64le",
"product": {
"name": "389-ds-base-snmp-0:2.6.1-22.el9_6.ppc64le",
"product_id": "389-ds-base-snmp-0:2.6.1-22.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp@2.6.1-22.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"product": {
"name": "389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"product_id": "389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debugsource@2.6.1-22.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"product": {
"name": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"product_id": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@2.6.1-22.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"product": {
"name": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"product_id": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@2.6.1-22.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"product": {
"name": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"product_id": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@2.6.1-22.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-devel-0:2.6.1-22.el9_6.ppc64le",
"product": {
"name": "389-ds-base-devel-0:2.6.1-22.el9_6.ppc64le",
"product_id": "389-ds-base-devel-0:2.6.1-22.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-devel@2.6.1-22.el9_6?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:2.6.1-22.el9_6.x86_64",
"product": {
"name": "389-ds-base-0:2.6.1-22.el9_6.x86_64",
"product_id": "389-ds-base-0:2.6.1-22.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@2.6.1-22.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:2.6.1-22.el9_6.x86_64",
"product": {
"name": "389-ds-base-libs-0:2.6.1-22.el9_6.x86_64",
"product_id": "389-ds-base-libs-0:2.6.1-22.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@2.6.1-22.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-0:2.6.1-22.el9_6.x86_64",
"product": {
"name": "389-ds-base-snmp-0:2.6.1-22.el9_6.x86_64",
"product_id": "389-ds-base-snmp-0:2.6.1-22.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp@2.6.1-22.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"product": {
"name": "389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"product_id": "389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debugsource@2.6.1-22.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"product": {
"name": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"product_id": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@2.6.1-22.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"product": {
"name": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"product_id": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@2.6.1-22.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64",
"product": {
"name": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64",
"product_id": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@2.6.1-22.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-devel-0:2.6.1-22.el9_6.x86_64",
"product": {
"name": "389-ds-base-devel-0:2.6.1-22.el9_6.x86_64",
"product_id": "389-ds-base-devel-0:2.6.1-22.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-devel@2.6.1-22.el9_6?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "389-ds-base-0:2.6.1-22.el9_6.s390x",
"product": {
"name": "389-ds-base-0:2.6.1-22.el9_6.s390x",
"product_id": "389-ds-base-0:2.6.1-22.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base@2.6.1-22.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-0:2.6.1-22.el9_6.s390x",
"product": {
"name": "389-ds-base-libs-0:2.6.1-22.el9_6.s390x",
"product_id": "389-ds-base-libs-0:2.6.1-22.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs@2.6.1-22.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-0:2.6.1-22.el9_6.s390x",
"product": {
"name": "389-ds-base-snmp-0:2.6.1-22.el9_6.s390x",
"product_id": "389-ds-base-snmp-0:2.6.1-22.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp@2.6.1-22.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"product": {
"name": "389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"product_id": "389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debugsource@2.6.1-22.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"product": {
"name": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"product_id": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-debuginfo@2.6.1-22.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"product": {
"name": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"product_id": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@2.6.1-22.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"product": {
"name": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"product_id": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@2.6.1-22.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "389-ds-base-devel-0:2.6.1-22.el9_6.s390x",
"product": {
"name": "389-ds-base-devel-0:2.6.1-22.el9_6.s390x",
"product_id": "389-ds-base-devel-0:2.6.1-22.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/389-ds-base-devel@2.6.1-22.el9_6?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-lib389-0:2.6.1-22.el9_6.noarch",
"product": {
"name": "python3-lib389-0:2.6.1-22.el9_6.noarch",
"product_id": "python3-lib389-0:2.6.1-22.el9_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-lib389@2.6.1-22.el9_6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:2.6.1-22.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.aarch64"
},
"product_reference": "389-ds-base-0:2.6.1-22.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:2.6.1-22.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.ppc64le"
},
"product_reference": "389-ds-base-0:2.6.1-22.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:2.6.1-22.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.s390x"
},
"product_reference": "389-ds-base-0:2.6.1-22.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:2.6.1-22.el9_6.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.src"
},
"product_reference": "389-ds-base-0:2.6.1-22.el9_6.src",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-0:2.6.1-22.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.x86_64"
},
"product_reference": "389-ds-base-0:2.6.1-22.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64"
},
"product_reference": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le"
},
"product_reference": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x"
},
"product_reference": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64"
},
"product_reference": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64"
},
"product_reference": "389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le"
},
"product_reference": "389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x"
},
"product_reference": "389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64"
},
"product_reference": "389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:2.6.1-22.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.aarch64"
},
"product_reference": "389-ds-base-libs-0:2.6.1-22.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:2.6.1-22.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.ppc64le"
},
"product_reference": "389-ds-base-libs-0:2.6.1-22.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:2.6.1-22.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.s390x"
},
"product_reference": "389-ds-base-libs-0:2.6.1-22.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-0:2.6.1-22.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.x86_64"
},
"product_reference": "389-ds-base-libs-0:2.6.1-22.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64"
},
"product_reference": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le"
},
"product_reference": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x"
},
"product_reference": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64"
},
"product_reference": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:2.6.1-22.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.aarch64"
},
"product_reference": "389-ds-base-snmp-0:2.6.1-22.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:2.6.1-22.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.ppc64le"
},
"product_reference": "389-ds-base-snmp-0:2.6.1-22.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:2.6.1-22.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.s390x"
},
"product_reference": "389-ds-base-snmp-0:2.6.1-22.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-0:2.6.1-22.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.x86_64"
},
"product_reference": "389-ds-base-snmp-0:2.6.1-22.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-lib389-0:2.6.1-22.el9_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:python3-lib389-0:2.6.1-22.el9_6.noarch"
},
"product_reference": "python3-lib389-0:2.6.1-22.el9_6.noarch",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64"
},
"product_reference": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le"
},
"product_reference": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x"
},
"product_reference": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64"
},
"product_reference": "389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64"
},
"product_reference": "389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le"
},
"product_reference": "389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x"
},
"product_reference": "389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64"
},
"product_reference": "389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:2.6.1-22.el9_6.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.aarch64"
},
"product_reference": "389-ds-base-devel-0:2.6.1-22.el9_6.aarch64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:2.6.1-22.el9_6.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.ppc64le"
},
"product_reference": "389-ds-base-devel-0:2.6.1-22.el9_6.ppc64le",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:2.6.1-22.el9_6.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.s390x"
},
"product_reference": "389-ds-base-devel-0:2.6.1-22.el9_6.s390x",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-devel-0:2.6.1-22.el9_6.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.x86_64"
},
"product_reference": "389-ds-base-devel-0:2.6.1-22.el9_6.x86_64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64"
},
"product_reference": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le"
},
"product_reference": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x"
},
"product_reference": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64"
},
"product_reference": "389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64"
},
"product_reference": "389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11610",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-04-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484414"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server\n(389-ds-base). After a successful SASL bind with integrity protection (SSF \u003e 0),\nan authenticated attacker can send a specially crafted oversized LDAP UNBIND packet\nthat is copied into a 512-byte heap receive buffer without a bounds check in\nsasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of\nattacker-controlled data to overflow the buffer, causing a denial of service (server\ncrash). In FreeIPA and Red Hat Identity Management deployments, any domain user with\na valid Kerberos ticket, any enrolled host, or any service account can trigger this\nvulnerability over the network after authenticating via GSSAPI.\nThe vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and\nwas not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow\nin schema.c only.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important impact. After a successful SASL bind with integrity protection (SSF \u003e 0), an authenticated remote attacker can send a crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv(). Up to roughly two megabytes of attacker-controlled data can overflow the buffer, reliably crashing ns-slapd on production builds. Exploitation requires a valid SASL-authenticated LDAP session, not Directory Manager access. Any user who can bind with SASL mechanisms such as GSSAPI/Kerberos or DIGEST-MD5 can trigger the denial of service. In deployments where domain users, enrolled hosts, and service accounts routinely authenticate to the directory over Kerberos, the attack surface includes any such principal with network access to LDAP. This flaw is independent of CVE-2025-14905, which patched a separate heap overflow in schema.c and did not modify sasl_io.c.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.src",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:python3-lib389-0:2.6.1-22.el9_6.noarch",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11610"
},
{
"category": "external",
"summary": "RHBZ#2484414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11610"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610"
}
],
"release_date": "2026-07-07T09:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T12:25:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.src",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:python3-lib389-0:2.6.1-22.el9_6.noarch",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36671"
},
{
"category": "workaround",
"details": "There is no complete workaround for this flaw.\nMitigations that reduce exposure:\n1. Restrict network access to LDAP ports (389/636) to trusted networks only.\n Note: In FreeIPA/IdM deployments, enrolled clients require LDAP access and\n this may not be practical.\n2. If DIGEST-MD5 is not required, disable it via nsslapd-allowed-sasl-mechanisms\n in cn=config. GSSAPI/Kerberos cannot be disabled in FreeIPA/IdM without breaking\n domain authentication.\n3. Monitor for oversized LDAP UNBIND packets (standard UNBIND is 7 bytes; alert on\n UNBIND packets exceeding ~100 bytes).\n4. Lowering nsslapd-maxbersize reduces maximum overflow size but does not eliminate\n the vulnerability.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.src",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:python3-lib389-0:2.6.1-22.el9_6.noarch",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.src",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:python3-lib389-0:2.6.1-22.el9_6.noarch",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND"
},
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-11774",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484916"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF \u003e 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Important. After a successful SASL bind with integrity protection, an authenticated attacker can send a SASL-framed packet whose length prefix wraps when processed in sasl_io_start_packet(), bypassing nsslapd-maxsasliosize and causing a heap buffer overflow of up to approximately two megabytes of attacker-controlled data.\n\nThis flaw is independent of CVE-2025-14905 (schema.c). Any domain user with a Kerberos ticket can trigger it remotely after GSSAPI authentication. Red Hat assigns C:L/I:L rather than Critical because remote code execution on current platforms with glibc 2.32+ is blocked by tcache safe linking; RCE was demonstrated on RHEL 8 with glibc 2.28 but required a heap address leak. Denial of service is reliable on all platforms.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.src",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:python3-lib389-0:2.6.1-22.el9_6.noarch",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11774"
},
{
"category": "external",
"summary": "RHBZ#2484916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11774",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905"
}
],
"release_date": "2026-06-04T21:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T12:25:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.src",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:python3-lib389-0:2.6.1-22.el9_6.noarch",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36671"
},
{
"category": "workaround",
"details": "No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.src",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:python3-lib389-0:2.6.1-22.el9_6.noarch",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.src",
"AppStream-9.6.0.Z.EUS:389-ds-base-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:python3-lib389-0:2.6.1-22.el9_6.noarch",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-debuginfo-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-debugsource-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-devel-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-libs-debuginfo-0:2.6.1-22.el9_6.x86_64",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.aarch64",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.ppc64le",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.s390x",
"CRB-9.6.0.Z.EUS:389-ds-base-snmp-debuginfo-0:2.6.1-22.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…