Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

CVE-2026-11610

389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind

HIGH 8.8

At a glance

Source
NVD
EPSS
EPSS 0.49 % · percentile 42 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Awaiting Analysis

Description

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.

Weaknesses (CWE)

  • CWE-122 — Heap-based Buffer Overflow

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hredhat
CVSS 3.1HIGH 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · secalert@redhat.com (Secondary)

European references

Affected products

ProductVersions
389ds · 389-ds-baseaffected 1.3.2 ≤ 3.3.0
Red Hat · Red Hat Directory Server 11.5 E4S for RHEL 8unaffected 8060020260702180044.0ca98e7e < *
Red Hat · Red Hat Directory Server 11.7 E4S for RHEL 8unaffected 8080020260702180836.f969626e < *
Red Hat · Red Hat Directory Server 11.9 for RHEL 8unaffected 8100020260702145313.37ed7c03 < *
Red Hat · Red Hat Directory Server 12.2 E4S for RHEL 9unaffected 9020020260703060155.1674d574 < *
Red Hat · Red Hat Directory Server 12.4 E4S for RHEL 9unaffected 9040020260703055735.1674d574 < *
Red Hat · Red Hat Enterprise Linux 10unaffected 0:3.2.0-8.el10_2 < *
Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Supportunaffected 0:3.0.6-19.el10_0 < *
Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Supportunaffected 0:1.3.11.1-13.el7_9 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 8100020260626120929.25e700aa < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 8040020260629123121.96015a92 < *
Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onunaffected 8040020260629123121.96015a92 < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 8060020260626130540.824efc52 < *
Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-Onunaffected 8060020260626130540.824efc52 < *
Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Serviceunaffected 8080020260630025241.6dbb3803 < *
Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionsunaffected 8080020260630025241.6dbb3803 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:2.8.0-8.el9_8 < *
Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionsunaffected 0:2.2.4-19.el9_2 < *
Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP Solutionsunaffected 0:2.4.5-26.el9_4 < *
Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Supportunaffected 0:2.6.1-22.el9_6 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD