← CVE Intelligence

CVE-2026-11610

389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind PUBLISHED

Description (CNA)

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.

Affected (CNA)

Vendor / productVersions
389ds / 389-ds-baseaffected 1.3.2 through 3.3.0
Red Hat / Red Hat Directory Server 11.5 E4S for RHEL 8unaffected 8060020260702180044.0ca98e7e before *
Red Hat / Red Hat Directory Server 11.7 E4S for RHEL 8unaffected 8080020260702180836.f969626e before *
Red Hat / Red Hat Directory Server 11.9 for RHEL 8unaffected 8100020260702145313.37ed7c03 before *
Red Hat / Red Hat Directory Server 12.2 E4S for RHEL 9unaffected 9020020260703060155.1674d574 before *
Red Hat / Red Hat Directory Server 12.4 E4S for RHEL 9unaffected 9040020260703055735.1674d574 before *
Red Hat / Red Hat Enterprise Linux 10unaffected 0:3.2.0-8.el10_2 before *
Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Supportunaffected 0:3.0.6-19.el10_0 before *
Red Hat / Red Hat Enterprise Linux 7 Extended Lifecycle Supportunaffected 0:1.3.11.1-13.el7_9 before *
Red Hat / Red Hat Enterprise Linux 8unaffected 8100020260626120929.25e700aa before *
Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 8040020260629123121.96015a92 before *
Red Hat / Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onunaffected 8040020260629123121.96015a92 before *
Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 8060020260626130540.824efc52 before *
Red Hat / Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-Onunaffected 8060020260626130540.824efc52 before *
Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Serviceunaffected 8080020260630025241.6dbb3803 before *
Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionsunaffected 8080020260630025241.6dbb3803 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:2.8.0-8.el9_8 before *
Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionsunaffected 0:2.2.4-19.el9_2 before *
Red Hat / Red Hat Enterprise Linux 9.4 Update Services for SAP Solutionsunaffected 0:2.4.5-26.el9_4 before *
Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Supportunaffected 0:2.6.1-22.el9_6 before *
Red Hat / Red Hat Directory Server 13.2unaffected 1783452100 before *
Red Hat / Red Hat Directory Server 12affected
Red Hat / Red Hat Directory Server 13unaffected
Red Hat / Red Hat Enterprise Linux 6affected

CWE

CWE-122

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.