Vulnerability-Lookup

RHSA-2026:55532

Vulnerability from csaf_redhat - Published: 2026-08-17 08:54 - Updated: 2026-08-17 21:12

Summary

Red Hat Security Advisory: redhat-ds:11 security update

Severity

Important

Notes

Topic: An update for the redhat-ds:11 module is now available for Red Hat Directory Server 11.9 for RHEL 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages for server administration. Additional Changes: For detailed information on changes in this release, see the Red Hat Directory Server 11.9 for RHEL 8 Release Notes linked from the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-11770

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-11788

A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-15722

A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-121 - Stack-based Buffer Overflow

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-DirSrv-11.9:python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11	—	Vendor Fix fix Workaround

Threats

Impact Important

References

20 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:55532	self
https://docs.redhat.com/en/documentation/red_hat_…	external
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2484802	external
https://bugzilla.redhat.com/show_bug.cgi?id=2485423	external
https://bugzilla.redhat.com/show_bug.cgi?id=2499961	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-11770	self
https://bugzilla.redhat.com/show_bug.cgi?id=2484802	external
https://www.cve.org/CVERecord?id=CVE-2026-11770	external
https://nvd.nist.gov/vuln/detail/CVE-2026-11770	external
https://github.com/389ds/389-ds-base/blob/main/ld…	external
https://access.redhat.com/security/cve/CVE-2026-11788	self
https://bugzilla.redhat.com/show_bug.cgi?id=2485423	external
https://www.cve.org/CVERecord?id=CVE-2026-11788	external
https://nvd.nist.gov/vuln/detail/CVE-2026-11788	external
https://access.redhat.com/security/cve/CVE-2026-15722	self
https://bugzilla.redhat.com/show_bug.cgi?id=2499961	external
https://www.cve.org/CVERecord?id=CVE-2026-15722	external
https://nvd.nist.gov/vuln/detail/CVE-2026-15722	external

Acknowledgments

Red Hat Ian Murphy

Sebastián Alba Vives

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the redhat-ds:11 module is now available for Red Hat Directory Server 11.9 for RHEL 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages for server administration.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Directory Server 11.9 for RHEL 8 Release Notes linked from the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:55532",
        "url": "https://access.redhat.com/errata/RHSA-2026:55532"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_directory_server/11/html/release_notes/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_directory_server/11/html/release_notes/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2484802",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484802"
      },
      {
        "category": "external",
        "summary": "2485423",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485423"
      },
      {
        "category": "external",
        "summary": "2499961",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499961"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55532.json"
      }
    ],
    "title": "Red Hat Security Advisory: redhat-ds:11 security update",
    "tracking": {
      "current_release_date": "2026-08-17T21:12:40+00:00",
      "generator": {
        "date": "2026-08-17T21:12:40+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:55532",
      "initial_release_date": "2026-08-17T08:54:20+00:00",
      "revision_history": [
        {
          "date": "2026-08-17T08:54:20+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-17T08:54:20+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-17T21:12:40+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Directory Server 11.9 for RHEL 8",
                "product": {
                  "name": "Red Hat Directory Server 11.9 for RHEL 8",
                  "product_id": "8Base-DirSrv-11.9",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:directory_server:11.9::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Directory Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11",
                "product": {
                  "name": "389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src (redhat-ds:11)",
                  "product_id": "389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/389-ds-base@1.4.3.39-26.module%2Bel8dsrv%2B24624%2Ba4839c0f?arch=src\u0026rpmmod=redhat-ds:11:8100020260803140625:37ed7c03"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                "product": {
                  "name": "389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11)",
                  "product_id": "389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/389-ds-base@1.4.3.39-26.module%2Bel8dsrv%2B24624%2Ba4839c0f?arch=x86_64\u0026rpmmod=redhat-ds:11:8100020260803140625:37ed7c03"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                "product": {
                  "name": "389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11)",
                  "product_id": "389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/389-ds-base-debuginfo@1.4.3.39-26.module%2Bel8dsrv%2B24624%2Ba4839c0f?arch=x86_64\u0026rpmmod=redhat-ds:11:8100020260803140625:37ed7c03"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                "product": {
                  "name": "389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11)",
                  "product_id": "389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/389-ds-base-debugsource@1.4.3.39-26.module%2Bel8dsrv%2B24624%2Ba4839c0f?arch=x86_64\u0026rpmmod=redhat-ds:11:8100020260803140625:37ed7c03"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                "product": {
                  "name": "389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11)",
                  "product_id": "389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/389-ds-base-devel@1.4.3.39-26.module%2Bel8dsrv%2B24624%2Ba4839c0f?arch=x86_64\u0026rpmmod=redhat-ds:11:8100020260803140625:37ed7c03"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                "product": {
                  "name": "389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11)",
                  "product_id": "389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/389-ds-base-legacy-tools@1.4.3.39-26.module%2Bel8dsrv%2B24624%2Ba4839c0f?arch=x86_64\u0026rpmmod=redhat-ds:11:8100020260803140625:37ed7c03"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                "product": {
                  "name": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11)",
                  "product_id": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/389-ds-base-legacy-tools-debuginfo@1.4.3.39-26.module%2Bel8dsrv%2B24624%2Ba4839c0f?arch=x86_64\u0026rpmmod=redhat-ds:11:8100020260803140625:37ed7c03"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                "product": {
                  "name": "389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11)",
                  "product_id": "389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/389-ds-base-libs@1.4.3.39-26.module%2Bel8dsrv%2B24624%2Ba4839c0f?arch=x86_64\u0026rpmmod=redhat-ds:11:8100020260803140625:37ed7c03"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                "product": {
                  "name": "389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11)",
                  "product_id": "389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/389-ds-base-libs-debuginfo@1.4.3.39-26.module%2Bel8dsrv%2B24624%2Ba4839c0f?arch=x86_64\u0026rpmmod=redhat-ds:11:8100020260803140625:37ed7c03"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                "product": {
                  "name": "389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11)",
                  "product_id": "389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/389-ds-base-snmp@1.4.3.39-26.module%2Bel8dsrv%2B24624%2Ba4839c0f?arch=x86_64\u0026rpmmod=redhat-ds:11:8100020260803140625:37ed7c03"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                "product": {
                  "name": "389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11)",
                  "product_id": "389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/389-ds-base-snmp-debuginfo@1.4.3.39-26.module%2Bel8dsrv%2B24624%2Ba4839c0f?arch=x86_64\u0026rpmmod=redhat-ds:11:8100020260803140625:37ed7c03"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
                "product": {
                  "name": "cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch (redhat-ds:11)",
                  "product_id": "cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cockpit-389-ds@1.4.3.39-26.module%2Bel8dsrv%2B24624%2Ba4839c0f?arch=noarch\u0026rpmmod=redhat-ds:11:8100020260803140625:37ed7c03"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
                "product": {
                  "name": "python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch (redhat-ds:11)",
                  "product_id": "python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-lib389@1.4.3.39-26.module%2Bel8dsrv%2B24624%2Ba4839c0f?arch=noarch\u0026rpmmod=redhat-ds:11:8100020260803140625:37ed7c03"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src (redhat-ds:11) as a component of Red Hat Directory Server 11.9 for RHEL 8",
          "product_id": "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11"
        },
        "product_reference": "389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11",
        "relates_to_product_reference": "8Base-DirSrv-11.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.9 for RHEL 8",
          "product_id": "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11"
        },
        "product_reference": "389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
        "relates_to_product_reference": "8Base-DirSrv-11.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.9 for RHEL 8",
          "product_id": "8Base-DirSrv-11.9:389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11"
        },
        "product_reference": "389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
        "relates_to_product_reference": "8Base-DirSrv-11.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.9 for RHEL 8",
          "product_id": "8Base-DirSrv-11.9:389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11"
        },
        "product_reference": "389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
        "relates_to_product_reference": "8Base-DirSrv-11.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.9 for RHEL 8",
          "product_id": "8Base-DirSrv-11.9:389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11"
        },
        "product_reference": "389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
        "relates_to_product_reference": "8Base-DirSrv-11.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.9 for RHEL 8",
          "product_id": "8Base-DirSrv-11.9:389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11"
        },
        "product_reference": "389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
        "relates_to_product_reference": "8Base-DirSrv-11.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.9 for RHEL 8",
          "product_id": "8Base-DirSrv-11.9:389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11"
        },
        "product_reference": "389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
        "relates_to_product_reference": "8Base-DirSrv-11.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.9 for RHEL 8",
          "product_id": "8Base-DirSrv-11.9:389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11"
        },
        "product_reference": "389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
        "relates_to_product_reference": "8Base-DirSrv-11.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.9 for RHEL 8",
          "product_id": "8Base-DirSrv-11.9:389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11"
        },
        "product_reference": "389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
        "relates_to_product_reference": "8Base-DirSrv-11.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.9 for RHEL 8",
          "product_id": "8Base-DirSrv-11.9:389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11"
        },
        "product_reference": "389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
        "relates_to_product_reference": "8Base-DirSrv-11.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64 (redhat-ds:11) as a component of Red Hat Directory Server 11.9 for RHEL 8",
          "product_id": "8Base-DirSrv-11.9:389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11"
        },
        "product_reference": "389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
        "relates_to_product_reference": "8Base-DirSrv-11.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch (redhat-ds:11) as a component of Red Hat Directory Server 11.9 for RHEL 8",
          "product_id": "8Base-DirSrv-11.9:cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11"
        },
        "product_reference": "cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
        "relates_to_product_reference": "8Base-DirSrv-11.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch (redhat-ds:11) as a component of Red Hat Directory Server 11.9 for RHEL 8",
          "product_id": "8Base-DirSrv-11.9:python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11"
        },
        "product_reference": "python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
        "relates_to_product_reference": "8Base-DirSrv-11.9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Ian Murphy"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-11770",
      "cwe": {
        "id": "CWE-90",
        "name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
      },
      "discovery_date": "2026-04-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484802"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A Moderate impact information disclosure flaw was found in 389 Directory Server. An unauthenticated remote attacker can exploit an LDAP filter injection vulnerability in the CleanAllRUV status-check extended operation. Red Hat products with `nsslapd-allow-anonymous-access` enabled by default are particularly susceptible.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
          "8Base-DirSrv-11.9:python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11770"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484802",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484802"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11770",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11770"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11770",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11770"
        },
        {
          "category": "external",
          "summary": "https://github.com/389ds/389-ds-base/blob/main/ldap/servers/plugins/replication/repl_extop.c",
          "url": "https://github.com/389ds/389-ds-base/blob/main/ldap/servers/plugins/replication/repl_extop.c"
        }
      ],
      "release_date": "2026-07-31T09:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T08:54:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
            "8Base-DirSrv-11.9:python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55532"
        },
        {
          "category": "workaround",
          "details": "Set nsslapd-allow-anonymous-access to rootdse or off. Restrict LDAP ports to trusted networks. Monitor for extop OID 2.16.840.1.113730.3.6.8. Use strong replication manager passwords.",
          "product_ids": [
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
            "8Base-DirSrv-11.9:python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
            "8Base-DirSrv-11.9:python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Ian Murphy"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-11788",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-04-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2485423"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this issue as Moderate impact. The dereference control plugin in 389-ds-base does not check whether ber_init() succeeded before using the BER structure. If allocation fails, an LDAP search carrying the deref control can crash ns-slapd. The deref plugin is enabled by default, and anonymous clients can send the control when anonymous access is allowed.\nNVD rates this 7.5 (AC:L); Red Hat rates 5.9 (AC:H) because the NULL return from ber_init() occurs when memory allocation fails, not from a crafted control payload alone\u2014a well-formed deref search on a server with normal free memory does not trigger the crash. Natural OOM was not demonstrated end-to-end without fault injection. Disabling the deref plugin removes the vulnerable code path entirely.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
          "8Base-DirSrv-11.9:python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11788"
        },
        {
          "category": "external",
          "summary": "RHBZ#2485423",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485423"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11788",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11788"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11788",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11788"
        }
      ],
      "release_date": "2026-04-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T08:54:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
            "8Base-DirSrv-11.9:python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55532"
        },
        {
          "category": "workaround",
          "details": "Disable the deref plugin (most effective): dsconf \u003cinstance\u003e plugin deref disable; systemctl restart dirsrv@\u003cinstance\u003e. Disable anonymous access (nsslapd-allow-anonymous-access=off) to raise the bar from pre-auth to authenticated exploitation. Configure memory limits as defense-in-depth: set nsslapd-maxbersize and nsslapd-conntablesize, and deploy in a cgroup with memory limits.",
          "product_ids": [
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
            "8Base-DirSrv-11.9:python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
            "8Base-DirSrv-11.9:python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Sebasti\u00e1n Alba Vives"
          ]
        }
      ],
      "cve": "CVE-2026-15722",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "discovery_date": "2026-04-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499961"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw allows a remote unauthenticated attacker to crash the 389 Directory Server (ns-slapd) by sending a single crafted LDAP extended operation targeting the replication subsystem. The overflow is triggered during payload decoding, before the server checks whether the caller is authorized, so no credentials are needed on default configurations where anonymous access is enabled. The overflow data is limited to ASCII digit characters and a null byte. Stack protectors and ASLR prevent the overflow from being leveraged for code execution \u2014 the stack canary detects the corruption and aborts the process. The practical impact is therefore limited to denial of service. Customers who have restricted network access to the LDAP port to trusted replication partners, or who have disabled anonymous access by setting nsslapd-allow-anonymous-access to \u0027off\u0027 or \u0027rootdse\u0027, are not exposed to unauthenticated exploitation of this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
          "8Base-DirSrv-11.9:cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
          "8Base-DirSrv-11.9:python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15722"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499961",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499961"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15722",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15722"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15722",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15722"
        }
      ],
      "release_date": "2026-07-31T09:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T08:54:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
            "8Base-DirSrv-11.9:python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55532"
        },
        {
          "category": "workaround",
          "details": "Disable anonymous access by setting nsslapd-allow-anonymous-access to \u0027off\u0027 or \u0027rootdse\u0027 in cn=config. Alternatively, restrict network access to the LDAP port to trusted replication partners only using firewall rules.",
          "product_ids": [
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
            "8Base-DirSrv-11.9:python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-debugsource-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-devel-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-legacy-tools-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-libs-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:389-ds-base-snmp-debuginfo-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11",
            "8Base-DirSrv-11.9:cockpit-389-ds-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11",
            "8Base-DirSrv-11.9:python3-lib389-0:1.4.3.39-26.module+el8dsrv+24624+a4839c0f.noarch::redhat-ds:11"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing"
    }
  ]
}

CVE-2026-11770 (GCVE-0-2026-11770)

Vulnerability from cvelistv5 – Published: 2026-07-31 09:18 – Updated: 2026-08-17 21:12

Title

389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-31 23:22 UTC

CWE

CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Assigner

redhat

References

15 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:55421	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55422	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55423	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55424	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55425	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55426	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55530	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55532	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55756	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55757	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55758	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55794	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-11770	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2484802	issue-trackingx_refsource_REDHAT
https://github.com/389ds/389-ds-base/blob/main/ld…

Impacted products

18 products

Vendor	Product	Version
Red Hat	Red Hat Directory Server 11.9 for RHEL 8	Unaffected: 8100020260803140625.37ed7c03 , < * (rpm) cpe:/a:redhat:directory_server:11.9::el8
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.2.0-9.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:3.0.6-20.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.3.11.1-14.el7_9 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260806150504.25e700aa , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 8040020260803141511.96015a92 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 8040020260803141511.96015a92 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 8060020260806120442.824efc52 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 8060020260806120442.824efc52 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 8080020260806114228.6dbb3803 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 8080020260806114228.6dbb3803 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.8.0-9.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:2.2.4-20.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:2.4.5-27.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4::appstream
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:2.6.1-23.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6::appstream cpe:/a:redhat:rhel_eus:9.6::crb
Red Hat	Red Hat Directory Server 12	cpe:/a:redhat:directory_server:12
Red Hat	Red Hat Directory Server 13	cpe:/a:redhat:directory_server:13
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6

Date Public

2026-07-31 09:00

Credits

This issue was discovered by Ian Murphy (Red Hat).

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11770",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-31T23:22:55.275926Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-31T23:24:38.899Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server:11.9::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-ds:11",
          "product": "Red Hat Directory Server 11.9 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020260803140625.37ed7c03",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.2.0-9.el10_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux_eus:10.0"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.0.6-20.el10_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.3.11.1-14.el7_9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020260806150504.25e700aa",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8040020260803141511.96015a92",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8040020260803141511.96015a92",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020260806120442.824efc52",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020260806120442.824efc52",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8080020260806114228.6dbb3803",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8080020260806114228.6dbb3803",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.8.0-9.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.2.4-20.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.4.5-27.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::appstream",
            "cpe:/a:redhat:rhel_eus:9.6::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.6.1-23.el9_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server:12"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-ds:12/389-ds-base",
          "product": "Red Hat Directory Server 12",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server:13"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Directory Server 13",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by Ian Murphy (Red Hat)."
        }
      ],
      "datePublic": "2026-07-31T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-90",
              "description": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T21:12:43.681Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:55421",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55421"
        },
        {
          "name": "RHSA-2026:55422",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55422"
        },
        {
          "name": "RHSA-2026:55423",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55423"
        },
        {
          "name": "RHSA-2026:55424",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55424"
        },
        {
          "name": "RHSA-2026:55425",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55425"
        },
        {
          "name": "RHSA-2026:55426",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55426"
        },
        {
          "name": "RHSA-2026:55530",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55530"
        },
        {
          "name": "RHSA-2026:55532",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55532"
        },
        {
          "name": "RHSA-2026:55756",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55756"
        },
        {
          "name": "RHSA-2026:55757",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55757"
        },
        {
          "name": "RHSA-2026:55758",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55758"
        },
        {
          "name": "RHSA-2026:55794",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55794"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-11770"
        },
        {
          "name": "RHBZ#2484802",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484802"
        },
        {
          "url": "https://github.com/389ds/389-ds-base/blob/main/ldap/servers/plugins/replication/repl_extop.c"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-22T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-31T09:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check",
      "workarounds": [
        {
          "lang": "en",
          "value": "Set nsslapd-allow-anonymous-access to rootdse or off. Restrict LDAP ports to trusted networks. Monitor for extop OID 2.16.840.1.113730.3.6.8. Use strong replication manager passwords."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-11770",
    "datePublished": "2026-07-31T09:18:58.342Z",
    "dateReserved": "2026-06-09T11:25:26.667Z",
    "dateUpdated": "2026-08-17T21:12:43.681Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11788 (GCVE-0-2026-11788)

Vulnerability from cvelistv5 – Published: 2026-06-09 13:02 – Updated: 2026-08-17 21:12

Title

389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser

Summary

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-09 15:11 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

redhat

References

14 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:55421	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55422	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55423	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55424	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55425	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55426	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55530	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55532	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55756	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55757	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55758	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55794	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-11788	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2485423	issue-trackingx_refsource_REDHAT

Impacted products

18 products

Vendor	Product	Version
Red Hat	Red Hat Directory Server 11.9 for RHEL 8	Unaffected: 8100020260803140625.37ed7c03 , < * (rpm) cpe:/a:redhat:directory_server:11.9::el8
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.2.0-9.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:3.0.6-20.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.3.11.1-14.el7_9 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260806150504.25e700aa , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 8040020260803141511.96015a92 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 8040020260803141511.96015a92 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 8060020260806120442.824efc52 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 8060020260806120442.824efc52 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 8080020260806114228.6dbb3803 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 8080020260806114228.6dbb3803 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.8.0-9.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:2.2.4-20.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:2.4.5-27.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4::appstream
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:2.6.1-23.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6::appstream cpe:/a:redhat:rhel_eus:9.6::crb
Red Hat	Red Hat Directory Server 12	cpe:/a:redhat:directory_server:12
Red Hat	Red Hat Directory Server 13	cpe:/a:redhat:directory_server:13
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6

Date Public

2026-04-16 00:00

Credits

This issue was discovered by Ian Murphy (Red Hat).

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11788",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T15:11:26.743552Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T15:12:38.533Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server:11.9::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-ds:11",
          "product": "Red Hat Directory Server 11.9 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020260803140625.37ed7c03",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.2.0-9.el10_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux_eus:10.0"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.0.6-20.el10_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.3.11.1-14.el7_9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020260806150504.25e700aa",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8040020260803141511.96015a92",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8040020260803141511.96015a92",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020260806120442.824efc52",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020260806120442.824efc52",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8080020260806114228.6dbb3803",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8080020260806114228.6dbb3803",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.8.0-9.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.2.4-20.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.4.5-27.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::appstream",
            "cpe:/a:redhat:rhel_eus:9.6::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.6.1-23.el9_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server:12"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-ds:12/389-ds-base",
          "product": "Red Hat Directory Server 12",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server:13"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Directory Server 13",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by Ian Murphy (Red Hat)."
        }
      ],
      "datePublic": "2026-04-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T21:12:48.521Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:55421",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55421"
        },
        {
          "name": "RHSA-2026:55422",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55422"
        },
        {
          "name": "RHSA-2026:55423",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55423"
        },
        {
          "name": "RHSA-2026:55424",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55424"
        },
        {
          "name": "RHSA-2026:55425",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55425"
        },
        {
          "name": "RHSA-2026:55426",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55426"
        },
        {
          "name": "RHSA-2026:55530",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55530"
        },
        {
          "name": "RHSA-2026:55532",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55532"
        },
        {
          "name": "RHSA-2026:55756",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55756"
        },
        {
          "name": "RHSA-2026:55757",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55757"
        },
        {
          "name": "RHSA-2026:55758",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55758"
        },
        {
          "name": "RHSA-2026:55794",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55794"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-11788"
        },
        {
          "name": "RHBZ#2485423",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485423"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-16T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-04-16T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser",
      "workarounds": [
        {
          "lang": "en",
          "value": "Disable the deref plugin (most effective): dsconf \u003cinstance\u003e plugin deref disable; systemctl restart dirsrv@\u003cinstance\u003e. Disable anonymous access (nsslapd-allow-anonymous-access=off) to raise the bar from pre-auth to authenticated exploitation. Configure memory limits as defense-in-depth: set nsslapd-maxbersize and nsslapd-conntablesize, and deploy in a cgroup with memory limits."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-476: NULL Pointer Dereference"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-11788",
    "datePublished": "2026-06-09T13:02:53.715Z",
    "dateReserved": "2026-06-09T12:57:59.740Z",
    "dateUpdated": "2026-08-17T21:12:48.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15722 (GCVE-0-2026-15722)

Vulnerability from cvelistv5 – Published: 2026-07-31 09:18 – Updated: 2026-08-17 20:20

Title

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-31 10:41 UTC

CWE

CWE-121 - Stack-based Buffer Overflow

Assigner

redhat

References

14 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:55421	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55422	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55423	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55424	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55425	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55426	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55530	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55532	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55756	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55757	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55758	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55794	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-15722	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2499961	issue-trackingx_refsource_REDHAT

Impacted products

18 products

Vendor	Product	Version
Red Hat	Red Hat Directory Server 11.9 for RHEL 8	Unaffected: 8100020260803140625.37ed7c03 , < * (rpm) cpe:/a:redhat:directory_server:11.9::el8
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.2.0-9.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:3.0.6-20.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.3.11.1-14.el7_9 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260806150504.25e700aa , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 8040020260803141511.96015a92 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 8040020260803141511.96015a92 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 8060020260806120442.824efc52 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 8060020260806120442.824efc52 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 8080020260806114228.6dbb3803 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 8080020260806114228.6dbb3803 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.8.0-9.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:2.2.4-20.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:2.4.5-27.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4::appstream
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:2.6.1-23.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6::appstream cpe:/a:redhat:rhel_eus:9.6::crb
Red Hat	Red Hat Directory Server 12	cpe:/a:redhat:directory_server:12
Red Hat	Red Hat Directory Server 13	cpe:/a:redhat:directory_server:13
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6

Date Public

2026-07-31 09:00

Credits

Red Hat would like to thank Sebastián Alba Vives for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15722",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-31T10:41:52.360035Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-31T10:44:58.315Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server:11.9::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-ds:11",
          "product": "Red Hat Directory Server 11.9 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020260803140625.37ed7c03",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.2.0-9.el10_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux_eus:10.0"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.0.6-20.el10_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.3.11.1-14.el7_9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020260806150504.25e700aa",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8040020260803141511.96015a92",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8040020260803141511.96015a92",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020260806120442.824efc52",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020260806120442.824efc52",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8080020260806114228.6dbb3803",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8080020260806114228.6dbb3803",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.8.0-9.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.2.4-20.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.4.5-27.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::appstream",
            "cpe:/a:redhat:rhel_eus:9.6::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.6.1-23.el9_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server:12"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-ds:12/389-ds-base",
          "product": "Red Hat Directory Server 12",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server:13"
          ],
          "defaultStatus": "unaffected",
          "packageName": "389-ds-base",
          "product": "Red Hat Directory Server 13",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Sebasti\u00e1n Alba Vives for reporting this issue."
        }
      ],
      "datePublic": "2026-07-31T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T20:20:00.135Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:55421",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55421"
        },
        {
          "name": "RHSA-2026:55422",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55422"
        },
        {
          "name": "RHSA-2026:55423",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55423"
        },
        {
          "name": "RHSA-2026:55424",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55424"
        },
        {
          "name": "RHSA-2026:55425",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55425"
        },
        {
          "name": "RHSA-2026:55426",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55426"
        },
        {
          "name": "RHSA-2026:55530",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55530"
        },
        {
          "name": "RHSA-2026:55532",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55532"
        },
        {
          "name": "RHSA-2026:55756",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55756"
        },
        {
          "name": "RHSA-2026:55757",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55757"
        },
        {
          "name": "RHSA-2026:55758",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55758"
        },
        {
          "name": "RHSA-2026:55794",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55794"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-15722"
        },
        {
          "name": "RHBZ#2499961",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499961"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-01T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-31T09:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing",
      "workarounds": [
        {
          "lang": "en",
          "value": "Disable anonymous access by setting nsslapd-allow-anonymous-access to \u0027off\u0027 or \u0027rootdse\u0027 in cn=config. Alternatively, restrict network access to the LDAP port to trusted replication partners only using firewall rules."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-121: Stack-based Buffer Overflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-15722",
    "datePublished": "2026-07-31T09:18:50.308Z",
    "dateReserved": "2026-07-14T12:55:19.649Z",
    "dateUpdated": "2026-08-17T20:20:00.135Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:55532

CVE-2026-11770 (GCVE-0-2026-11770)

CVE-2026-11788 (GCVE-0-2026-11788)

CVE-2026-15722 (GCVE-0-2026-15722)

Tags

Sightings

Nomenclature