Red Hat Security Advisory: 389-ds-base security update
389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check (CVE-2026-11770) * 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser (CVE-2026-11788) * 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing (CVE-2026-15722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
The 389 Directory Server, an LDAPv3 compliant server used in Red Hat Enterprise Linux, contains multiple security flaws. CVE-2026-11770 is an LDAP filter injection vulnerability in the CleanAllRUV status-check extended operation that allows unauthenticated attackers to extract sensitive configuration data, including replication bind DNs and password storage schemes. CVE-2026-11788 is a NULL pointer dereference in the deref control plugin BER parser. CVE-2026-15722 is a pre-authentication stack buffer overflow caused by unbounded replica ID parsing in get_ruvelement_from_berval(). Red Hat has released security updates for these vulnerabilities in version 389-ds-base-2.2.4-20.el9_2 and related packages for Red Hat Enterprise Linux 9.2 variants. The LDAP filter injection has a CVSS v3 score of 7.5 (High) with no privileges required and network attack vector. Mitigations include disabling anonymous access (setting nsslapd-allow-anonymous-access to rootdse or off), restricting LDAP ports to trusted networks, monitoring for specific extended operation OIDs, and using strong replication manager passwords.
Potential Impact
The LDAP filter injection vulnerability (CVE-2026-11770) allows unauthenticated remote attackers to extract sensitive server configuration metadata, potentially exposing replication bind distinguished names and password storage scheme information. This can lead to information disclosure without requiring authentication. The NULL pointer dereference (CVE-2026-11788) and stack buffer overflow (CVE-2026-15722) vulnerabilities could cause denial of service or potentially allow code execution, but specific impacts are not detailed in the provided data. Overall, these vulnerabilities pose a high security risk to affected systems.
Mitigation Recommendations
Red Hat has released an official security update fixing these vulnerabilities in 389-ds-base version 2.2.4-20.el9_2 for Red Hat Enterprise Linux 9.2 and related variants. Users should apply this update promptly. Additionally, to mitigate the LDAP filter injection vulnerability, set the nsslapd-allow-anonymous-access parameter to rootdse or off, restrict LDAP ports to trusted networks, monitor for the extended operation OID 2.16.840.1.113730.3.6.8, and use strong replication manager passwords. These mitigations reduce exposure until the update is applied.
Red Hat Security Advisory: 389-ds-base security update
Description
389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check (CVE-2026-11770) * 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser (CVE-2026-11788) * 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing (CVE-2026-15722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 389 Directory Server, an LDAPv3 compliant server used in Red Hat Enterprise Linux, contains multiple security flaws. CVE-2026-11770 is an LDAP filter injection vulnerability in the CleanAllRUV status-check extended operation that allows unauthenticated attackers to extract sensitive configuration data, including replication bind DNs and password storage schemes. CVE-2026-11788 is a NULL pointer dereference in the deref control plugin BER parser. CVE-2026-15722 is a pre-authentication stack buffer overflow caused by unbounded replica ID parsing in get_ruvelement_from_berval(). Red Hat has released security updates for these vulnerabilities in version 389-ds-base-2.2.4-20.el9_2 and related packages for Red Hat Enterprise Linux 9.2 variants. The LDAP filter injection has a CVSS v3 score of 7.5 (High) with no privileges required and network attack vector. Mitigations include disabling anonymous access (setting nsslapd-allow-anonymous-access to rootdse or off), restricting LDAP ports to trusted networks, monitoring for specific extended operation OIDs, and using strong replication manager passwords.
Potential Impact
The LDAP filter injection vulnerability (CVE-2026-11770) allows unauthenticated remote attackers to extract sensitive server configuration metadata, potentially exposing replication bind distinguished names and password storage scheme information. This can lead to information disclosure without requiring authentication. The NULL pointer dereference (CVE-2026-11788) and stack buffer overflow (CVE-2026-15722) vulnerabilities could cause denial of service or potentially allow code execution, but specific impacts are not detailed in the provided data. Overall, these vulnerabilities pose a high security risk to affected systems.
Mitigation Recommendations
Red Hat has released an official security update fixing these vulnerabilities in 389-ds-base version 2.2.4-20.el9_2 for Red Hat Enterprise Linux 9.2 and related variants. Users should apply this update promptly. Additionally, to mitigate the LDAP filter injection vulnerability, set the nsslapd-allow-anonymous-access parameter to rootdse or off, restrict LDAP ports to trusted networks, monitor for the extended operation OID 2.16.840.1.113730.3.6.8, and use strong replication manager passwords. These mitigations reduce exposure until the update is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-r7mx-568f-jgg3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-11770"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a6cc13c1aa972dd3209d05d
Added to database: 07/31/2026, 15:37:32 UTC
Last enriched: 08/17/2026, 17:58:02 UTC
Last updated: 09/14/2026, 22:01:31 UTC
Views: 102
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.