389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind
Summary
| CVE | CVE-2026-11610 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-07 10:16:39 UTC |
| Updated | 2026-07-08 21:16:46 UTC |
| Description | A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only. |
Risk And Classification
Primary CVSS: v3.1 8.8 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.006270000 probability, percentile 0.458390000 (date 2026-07-11)
Problem Types: CWE-122 | CWE-122 Heap-based Buffer Overflow
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | 389ds | 389-ds-base | affected 1.3.2 3.3.0 semver | Not specified |
| CNA | Red Hat | Red Hat Directory Server 11.5 E4S For RHEL 8 | unaffected 8060020260702180044.0ca98e7e * rpm | Not specified |
| CNA | Red Hat | Red Hat Directory Server 11.7 E4S For RHEL 8 | unaffected 8080020260702180836.f969626e * rpm | Not specified |
| CNA | Red Hat | Red Hat Directory Server 11.9 For RHEL 8 | unaffected 8100020260702145313.37ed7c03 * rpm | Not specified |
| CNA | Red Hat | Red Hat Directory Server 12.2 E4S For RHEL 9 | unaffected 9020020260703060155.1674d574 * rpm | Not specified |
| CNA | Red Hat | Red Hat Directory Server 12.4 E4S For RHEL 9 | unaffected 9040020260703055735.1674d574 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 10 | unaffected 0:3.2.0-8.el10_2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | unaffected 0:3.0.6-19.el10_0 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | unaffected 0:1.3.11.1-13.el7_9 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 8100020260626120929.25e700aa * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | unaffected 8040020260629123121.96015a92 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | unaffected 8040020260629123121.96015a92 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | unaffected 8060020260626130540.824efc52 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | unaffected 8060020260626130540.824efc52 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | unaffected 8080020260630025241.6dbb3803 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.8 Update Services For SAP Solutions | unaffected 8080020260630025241.6dbb3803 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:2.8.0-8.el9_8 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions | unaffected 0:2.2.4-19.el9_2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.4 Update Services For SAP Solutions | unaffected 0:2.4.5-26.el9_4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | unaffected 0:2.6.1-22.el9_6 * rpm | Not specified |
| CNA | Red Hat | Red Hat Directory Server 13.2 | unaffected 1783452100 * rpm | Not specified |
| CNA | Red Hat | Red Hat Directory Server 12 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Directory Server 13 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:36202 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36641 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36660 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36201 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36200 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36670 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36206 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36198 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36195 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36671 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36585 | [email protected] | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36204 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36196 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36208 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36205 | [email protected] | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-11610 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36209 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36197 | [email protected] | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: This issue was discovered by Ian Murphy (Red Hat). (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-04-22T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2026-07-07T09:00:00.000Z | Made public. |
Workarounds
CNA: There is no complete workaround for this flaw. Mitigations that reduce exposure: 1. Restrict network access to LDAP ports (389/636) to trusted networks only. Note: In FreeIPA/IdM deployments, enrolled clients require LDAP access and this may not be practical. 2. If DIGEST-MD5 is not required, disable it via nsslapd-allowed-sasl-mechanisms in cn=config. GSSAPI/Kerberos cannot be disabled in FreeIPA/IdM without breaking domain authentication. 3. Monitor for oversized LDAP UNBIND packets (standard UNBIND is 7 bytes; alert on UNBIND packets exceeding ~100 bytes). 4. Lowering nsslapd-maxbersize reduces maximum overflow size but does not eliminate the vulnerability.
There are currently no legacy QID mappings associated with this CVE.