Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

The Red Hat advisory RHSA-2026:64778 addresses four critical vulnerabilities in 389-ds-base, the LDAPv3 compliant server. CVE-2026-18355 is a heap buffer overflow caused by a SASL wrapped-record length lower-bound underflow in sasl_io_start_packet(). CVE-2026-18453 is a pre-authentication NULL pointer dereference triggered via paged results and USE_ONE_BACKEND control in op_shared_search. CVE-2026-18922 allows privilege escalation to Directory Manager through SASL PLAIN authentication due to a stale identity in the Cyrus SASL auxiliary property. CVE-2026-76560 permits an anonymous LDAP client to bypass SELFDN ACI bind-rule checks using an empty bind DN. The advisory also includes bug fixes for replication initialization issues. The update is available for Red Hat Enterprise Linux 9.2 across multiple architectures.

Successful exploitation of these vulnerabilities could result in denial of service via crashes (heap buffer overflow and NULL pointer dereference), unauthorized privilege escalation to Directory Manager, and bypass of access control checks by anonymous clients. This compromises the integrity and availability of the LDAP directory service and potentially allows attackers to gain elevated privileges or disrupt service.

An updated 389-ds-base package addressing these vulnerabilities is available for Red Hat Enterprise Linux 9.2. Users should apply the official Red Hat update as described in the advisory RHSA-2026:64778 and the referenced article https://access.redhat.com/articles/11258. This update includes security fixes and bug corrections. No additional mitigation steps are indicated by the vendor beyond applying the update.