389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow
Summary
| CVE | CVE-2026-11774 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-11 19:16:37 UTC |
| Updated | 2026-07-15 02:18:03 UTC |
| Description | An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c. |
Risk And Classification
Primary CVSS: v3.1 7.6 HIGH from ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
EPSS: 0.006700000 probability, percentile 0.478730000 (date 2026-07-18)
Problem Types: CWE-190 | CWE-190 Integer Overflow or Wraparound
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | CVSS | 7.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H |
| 3.1 | [email protected] | Secondary | 7.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 7.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H |
| 3.1 | CNA | CVSS | 7.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Directory Server 11.5 E4S For RHEL 8 | unaffected 8060020260702180044.0ca98e7e * rpm | Not specified |
| CNA | Red Hat | Red Hat Directory Server 11.7 E4S For RHEL 8 | unaffected 8080020260702180836.f969626e * rpm | Not specified |
| CNA | Red Hat | Red Hat Directory Server 11.9 For RHEL 8 | unaffected 8100020260702145313.37ed7c03 * rpm | Not specified |
| CNA | Red Hat | Red Hat Directory Server 12.2 E4S For RHEL 9 | unaffected 9020020260703060155.1674d574 * rpm | Not specified |
| CNA | Red Hat | Red Hat Directory Server 12.4 E4S For RHEL 9 | unaffected 9040020260703055735.1674d574 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 10 | unaffected 0:3.2.0-8.el10_2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | unaffected 0:3.0.6-19.el10_0 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | unaffected 0:1.3.11.1-13.el7_9 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 8100020260626120929.25e700aa * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | unaffected 8040020260629123121.96015a92 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | unaffected 8040020260629123121.96015a92 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | unaffected 8060020260626130540.824efc52 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | unaffected 8060020260626130540.824efc52 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | unaffected 8080020260630025241.6dbb3803 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.8 Update Services For SAP Solutions | unaffected 8080020260630025241.6dbb3803 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:2.8.0-8.el9_8 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions | unaffected 0:2.2.4-19.el9_2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.4 Update Services For SAP Solutions | unaffected 0:2.4.5-26.el9_4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | unaffected 0:2.6.1-22.el9_6 * rpm | Not specified |
| CNA | Red Hat | Red Hat Directory Server 13.2 | unaffected 1783452100 * rpm | Not specified |
| CNA | Red Hat | Red Hat Directory Server 12 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Directory Server 13 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Directory Server 11.5 E4S For RHEL 8 | unaffected 8060020260702180044.0ca98e7e * rpm | Not specified |
| ADP | Red Hat | Red Hat Directory Server 11.7 E4S For RHEL 8 | unaffected 8080020260702180836.f969626e * rpm | Not specified |
| ADP | Red Hat | Red Hat Directory Server 11.9 For RHEL 8 | unaffected 8100020260702145313.37ed7c03 * rpm | Not specified |
| ADP | Red Hat | Red Hat Directory Server 12.2 E4S For RHEL 9 | unaffected 9020020260703060155.1674d574 * rpm | Not specified |
| ADP | Red Hat | Red Hat Directory Server 12.4 E4S For RHEL 9 | unaffected 9040020260703055735.1674d574 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 10 | unaffected 0:3.2.0-8.el10_2 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | unaffected 0:3.0.6-19.el10_0 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | unaffected 0:1.3.11.1-13.el7_9 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8 | unaffected 8100020260626120929.25e700aa * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | unaffected 8040020260629123121.96015a92 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | unaffected 8040020260629123121.96015a92 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | unaffected 8060020260626130540.824efc52 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | unaffected 8060020260626130540.824efc52 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | unaffected 8080020260630025241.6dbb3803 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8.8 Update Services For SAP Solutions | unaffected 8080020260630025241.6dbb3803 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:2.8.0-8.el9_8 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions | unaffected 0:2.2.4-19.el9_2 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9.4 Update Services For SAP Solutions | unaffected 0:2.4.5-26.el9_4 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | unaffected 0:2.6.1-22.el9_6 * rpm | Not specified |
| ADP | Red Hat | Red Hat Directory Server 13.2 | unaffected 1783452100 * rpm | Not specified |
| ADP | Red Hat | Red Hat Directory Server 12 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Directory Server 13 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:36205 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36200 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36660 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36196 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36670 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36641 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36202 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36208 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36198 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36197 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-11774 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36209 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11774.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36206 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36671 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36204 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36201 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36195 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36585 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| redhat.atlassian.net/browse/PSIRTSUPT-7600 | MITRE | redhat.atlassian.net | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: This issue was discovered by Ian Murphy (Red Hat). (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-04-16T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2026-06-04T21:00:00.000Z | Made public. |
| ADP | 2026-04-16T00:00:00.000Z | Reported to Red Hat. |
| ADP | 2026-06-04T21:00:00.000Z | Made public. |
Solutions
ADP: RHSA-2026:36205: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)
ADP: RHSA-2026:36200: Red Hat Directory Server 11.9 for RHEL 8
ADP: RHSA-2026:36670: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)
ADP: RHSA-2026:36196: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
ADP: RHSA-2026:36201: Red Hat Enterprise Linux AppStream (v. 8)
ADP: RHSA-2026:36206: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
ADP: RHSA-2026:36202: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
ADP: RHSA-2026:36197: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)
ADP: RHSA-2026:36585: Red Hat Enterprise Linux AppStream E4S (v.9.2)
ADP: RHSA-2026:36198: Red Hat Enterprise Linux AppStream E4S (v.9.4)
ADP: RHSA-2026:36671: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)
ADP: RHSA-2026:36195: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
ADP: RHSA-2026:36204: Red Hat Directory Server 11.5 E4S for RHEL 8
ADP: RHSA-2026:36208: Red Hat Directory Server 11.7 E4S for RHEL 8
ADP: RHSA-2026:36641: Red Hat Directory Server 12.2 E4S for RHEL 9
ADP: RHSA-2026:36209: Red Hat Directory Server 12.4 E4S for RHEL 9
ADP: RHSA-2026:36660: Red Hat Directory Server 13.2
Workarounds
CNA: No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.
ADP: No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.