CVE-2026-11610: Heap-based Buffer Overflow in Red Hat Red Hat Directory Server 11
CVE-2026-11610 is a heap-based buffer overflow vulnerability in the SASL I/O layer of 389 Directory Server (389-ds-base), affecting Red Hat Directory Server 11. After a successful SASL bind with integrity protection, an authenticated attacker can send an oversized LDAP UNBIND packet that overflows a 512-byte heap buffer, causing a denial of service (server crash). This vulnerability affects deployments using FreeIPA and Red Hat Identity Management where authenticated users or services can trigger the issue over the network. The vulnerable code has existed since approximately 2013 and was not addressed by a previous related fix. No official patch or remediation is currently confirmed by the vendor advisory.
AI Analysis
Technical Summary
A heap buffer overflow exists in the sasl_io_recv() function of the SASL I/O layer in 389 Directory Server (389-ds-base), used by Red Hat Directory Server 11. After an authenticated SASL bind with integrity protection (SSF > 0), an attacker can send a specially crafted LDAP UNBIND packet that exceeds the 512-byte heap receive buffer without bounds checking, allowing approximately 2 megabytes of attacker-controlled data to overflow the buffer. This leads to denial of service via server crash. The vulnerability affects any domain user with a valid Kerberos ticket, enrolled hosts, or service accounts in FreeIPA and Red Hat Identity Management deployments. The vulnerable code path dates back to 2013 (389-ds-base 1.3.2) and was not fixed by the earlier CVE-2025-14905 patch, which addressed a different heap overflow.
Potential Impact
Successful exploitation results in a denial of service condition due to server crash caused by heap buffer overflow. The vulnerability requires authentication and affects integrity-protected SASL binds. It impacts availability of the directory server service. There is no indication of code execution or data disclosure in the provided information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-11610 for current remediation guidance. No official fix or workaround is stated in the advisory content provided. Until a patch is available, restrict access to authenticated users and monitor for unusual LDAP UNBIND packets if possible.
CVE-2026-11610: Heap-based Buffer Overflow in Red Hat Red Hat Directory Server 11
Description
CVE-2026-11610 is a heap-based buffer overflow vulnerability in the SASL I/O layer of 389 Directory Server (389-ds-base), affecting Red Hat Directory Server 11. After a successful SASL bind with integrity protection, an authenticated attacker can send an oversized LDAP UNBIND packet that overflows a 512-byte heap buffer, causing a denial of service (server crash). This vulnerability affects deployments using FreeIPA and Red Hat Identity Management where authenticated users or services can trigger the issue over the network. The vulnerable code has existed since approximately 2013 and was not addressed by a previous related fix. No official patch or remediation is currently confirmed by the vendor advisory.
CVSS v3.1
Score 8.8high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A heap buffer overflow exists in the sasl_io_recv() function of the SASL I/O layer in 389 Directory Server (389-ds-base), used by Red Hat Directory Server 11. After an authenticated SASL bind with integrity protection (SSF > 0), an attacker can send a specially crafted LDAP UNBIND packet that exceeds the 512-byte heap receive buffer without bounds checking, allowing approximately 2 megabytes of attacker-controlled data to overflow the buffer. This leads to denial of service via server crash. The vulnerability affects any domain user with a valid Kerberos ticket, enrolled hosts, or service accounts in FreeIPA and Red Hat Identity Management deployments. The vulnerable code path dates back to 2013 (389-ds-base 1.3.2) and was not fixed by the earlier CVE-2025-14905 patch, which addressed a different heap overflow.
Potential Impact
Successful exploitation results in a denial of service condition due to server crash caused by heap buffer overflow. The vulnerability requires authentication and affects integrity-protected SASL binds. It impacts availability of the directory server service. There is no indication of code execution or data disclosure in the provided information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-11610 for current remediation guidance. No official fix or workaround is stated in the advisory content provided. Until a patch is available, restrict access to authenticated users and monitor for unusual LDAP UNBIND packets if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-06-08T16:13:02.502Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-11610","vendor":"Red Hat"}]
Threat ID: 6a4ccfd027e9c79719609a54
Added to database: 07/07/2026, 10:07:12 UTC
Last enriched: 07/07/2026, 10:21:41 UTC
Last updated: 07/07/2026, 10:21:41 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.