RHSA-2026:36660

Vulnerability from csaf_redhat - Published: 2026-07-08 10:38 - Updated: 2026-07-08 13:04
Summary
Red Hat Security Advisory: Red Hat Directory Server 13.2 container image update
Severity
Important
Notes
Topic: An updated Red Hat Directory Server 13.2 container image for RHEL 10 is now available in the Red Hat container registry, including bug fixes and security patches.
Details: Red Hat Directory Server is an LDAPv3-compliant directory server. The image is maintained by Red Hat and updated regularly. To pull this container image, run the following command: podman pull registry.redhat.io/dirsrv/dirsrv-container-rhel10:13.2
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-11610

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-122 - Heap-based Buffer Overflow
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-11774

An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.

7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64 —
Vendor Fix fix
Workaround
Threats
Impact Important
References
Acknowledgments
Red Hat Ian Murphy
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated Red Hat Directory Server 13.2 container image for RHEL 10 is now available in the Red Hat container registry, including bug fixes and security patches.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Directory Server is an LDAPv3-compliant directory server. The image is maintained by Red Hat and updated regularly.\nTo pull this container image, run the following command: podman pull registry.redhat.io/dirsrv/dirsrv-container-rhel10:13.2",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:36660",
        "url": "https://access.redhat.com/errata/RHSA-2026:36660"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-11610",
        "url": "https://access.redhat.com/security/cve/CVE-2026-11610"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-11774",
        "url": "https://access.redhat.com/security/cve/CVE-2026-11774"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/software/containers/search",
        "url": "https://catalog.redhat.com/software/containers/search"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_directory_server/13/html/red_hat_directory_server_13_release_notes/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_directory_server/13/html/red_hat_directory_server_13_release_notes/index"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36660.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Directory Server 13.2 container image update",
    "tracking": {
      "current_release_date": "2026-07-08T13:04:45+00:00",
      "generator": {
        "date": "2026-07-08T13:04:45+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.1"
        }
      },
      "id": "RHSA-2026:36660",
      "initial_release_date": "2026-07-08T10:38:06+00:00",
      "revision_history": [
        {
          "date": "2026-07-08T10:38:06+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-08T10:38:08+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-08T13:04:45+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Directory Server 13.2",
                "product": {
                  "name": "Red Hat Directory Server 13.2",
                  "product_id": "Red Hat Directory Server 13.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:directory_server:13.2::el10"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Directory Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64",
                "product": {
                  "name": "registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64",
                  "product_id": "registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/dirsrv-container-rhel10@sha256%3Aaa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3?arch=amd64\u0026repository_url=registry.redhat.io/dirsrv/dirsrv-container-rhel10\u0026tag=1783452100"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64 as a component of Red Hat Directory Server 13.2",
          "product_id": "Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
        },
        "product_reference": "registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64",
        "relates_to_product_reference": "Red Hat Directory Server 13.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Ian Murphy"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-11610",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "discovery_date": "2026-04-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484414"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server\n(389-ds-base). After a successful SASL bind with integrity protection (SSF \u003e 0),\nan authenticated attacker can send a specially crafted oversized LDAP UNBIND packet\nthat is copied into a 512-byte heap receive buffer without a bounds check in\nsasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of\nattacker-controlled data to overflow the buffer, causing a denial of service (server\ncrash). In FreeIPA and Red Hat Identity Management deployments, any domain user with\na valid Kerberos ticket, any enrolled host, or any service account can trigger this\nvulnerability over the network after authenticating via GSSAPI.\nThe vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and\nwas not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow\nin schema.c only.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this issue as Important impact. After a successful SASL bind with integrity protection (SSF \u003e 0), an authenticated remote attacker can send a crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv(). Up to roughly two megabytes of attacker-controlled data can overflow the buffer, reliably crashing ns-slapd on production builds. Exploitation requires a valid SASL-authenticated LDAP session, not Directory Manager access. Any user who can bind with SASL mechanisms such as GSSAPI/Kerberos or DIGEST-MD5 can trigger the denial of service. In deployments where domain users, enrolled hosts, and service accounts routinely authenticate to the directory over Kerberos, the attack surface includes any such principal with network access to LDAP. This flaw is independent of CVE-2025-14905, which patched a separate heap overflow in schema.c and did not modify sasl_io.c.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11610"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484414",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484414"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11610",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11610"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11610"
        }
      ],
      "release_date": "2026-07-07T09:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-08T10:38:06+00:00",
          "details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command. For more information about the image, search the \u003cimage_name\u003e in the Red Hat Ecosystem Catalog: https://catalog.redhat.com/software/containers/search",
          "product_ids": [
            "Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:36660"
        },
        {
          "category": "workaround",
          "details": "There is no complete workaround for this flaw.\nMitigations that reduce exposure:\n1. Restrict network access to LDAP ports (389/636) to trusted networks only.\n   Note: In FreeIPA/IdM deployments, enrolled clients require LDAP access and\n   this may not be practical.\n2. If DIGEST-MD5 is not required, disable it via nsslapd-allowed-sasl-mechanisms\n   in cn=config. GSSAPI/Kerberos cannot be disabled in FreeIPA/IdM without breaking\n   domain authentication.\n3. Monitor for oversized LDAP UNBIND packets (standard UNBIND is 7 bytes; alert on\n   UNBIND packets exceeding ~100 bytes).\n4. Lowering nsslapd-maxbersize reduces maximum overflow size but does not eliminate\n   the vulnerability.",
          "product_ids": [
            "Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Ian Murphy"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-11774",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-04-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484916"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF \u003e 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this issue as Important. After a successful SASL bind with integrity protection, an authenticated attacker can send a SASL-framed packet whose length prefix wraps when processed in sasl_io_start_packet(), bypassing nsslapd-maxsasliosize and causing a heap buffer overflow of up to approximately two megabytes of attacker-controlled data.\n\nThis flaw is independent of CVE-2025-14905 (schema.c). Any domain user with a Kerberos ticket can trigger it remotely after GSSAPI authentication. Red Hat assigns C:L/I:L rather than Critical because remote code execution on current platforms with glibc 2.32+ is blocked by tcache safe linking; RCE was demonstrated on RHEL 8 with glibc 2.28 but required a heap address leak. Denial of service is reliable on all platforms.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11774"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484916",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484916"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11774",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11774"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11774"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14905"
        }
      ],
      "release_date": "2026-06-04T21:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-08T10:38:06+00:00",
          "details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command. For more information about the image, search the \u003cimage_name\u003e in the Red Hat Ecosystem Catalog: https://catalog.redhat.com/software/containers/search",
          "product_ids": [
            "Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:36660"
        },
        {
          "category": "workaround",
          "details": "No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.",
          "product_ids": [
            "Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Directory Server 13.2:registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:aa1714d2a0202b523ea7ac400776122c1dbff3d17c184ae3e944460225fa8db3_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.