389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow
Summary
| CVE | CVE-2026-11774 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-11 19:16:37 UTC |
| Updated | 2026-07-09 13:16:46 UTC |
| Description | An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c. |
Risk And Classification
Primary CVSS: v3.1 7.6 HIGH from ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
EPSS: 0.006700000 probability, percentile 0.476890000 (date 2026-07-13)
Problem Types: CWE-190 | CWE-190 Integer Overflow or Wraparound
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | CVSS | 7.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H |
| 3.1 | [email protected] | Secondary | 7.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 7.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H |
| 3.1 | CNA | CVSS | 7.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:36205 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36200 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36660 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36196 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36670 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36641 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36202 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36208 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36198 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36197 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-11774 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36209 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11774.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36206 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36671 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36204 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36201 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36195 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36585 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| redhat.atlassian.net/browse/PSIRTSUPT-7600 | MITRE | redhat.atlassian.net | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: This issue was discovered by Ian Murphy (Red Hat). (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-04-16T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2026-06-04T21:00:00.000Z | Made public. |
| ADP | 2026-04-16T00:00:00.000Z | Reported to Red Hat. |
| ADP | 2026-06-04T21:00:00.000Z | Made public. |
Solutions
ADP: RHSA-2026:36205: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)
ADP: RHSA-2026:36200: Red Hat Directory Server 11.9 for RHEL 8
ADP: RHSA-2026:36670: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)
ADP: RHSA-2026:36196: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
ADP: RHSA-2026:36201: Red Hat Enterprise Linux AppStream (v. 8)
ADP: RHSA-2026:36206: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
ADP: RHSA-2026:36202: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
ADP: RHSA-2026:36197: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)
ADP: RHSA-2026:36585: Red Hat Enterprise Linux AppStream E4S (v.9.2)
ADP: RHSA-2026:36198: Red Hat Enterprise Linux AppStream E4S (v.9.4)
ADP: RHSA-2026:36671: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)
ADP: RHSA-2026:36195: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
ADP: RHSA-2026:36204: Red Hat Directory Server 11.5 E4S for RHEL 8
ADP: RHSA-2026:36208: Red Hat Directory Server 11.7 E4S for RHEL 8
ADP: RHSA-2026:36641: Red Hat Directory Server 12.2 E4S for RHEL 9
ADP: RHSA-2026:36209: Red Hat Directory Server 12.4 E4S for RHEL 9
ADP: RHSA-2026:36660: Red Hat Directory Server 13.2
Workarounds
CNA: No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.
ADP: No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.