Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

The advisory covers four critical security vulnerabilities in 389-ds-base: CVE-2026-18355 is a heap buffer overflow caused by a SASL wrapped-record length lower-bound underflow in sasl_io_start_packet(). CVE-2026-18453 is a pre-authentication NULL pointer dereference triggered via paged results and USE_ONE_BACKEND control in op_shared_search. CVE-2026-18922 allows privilege escalation to Directory Manager through SASL PLAIN authentication due to a stale identity in the Cyrus SASL auxiliary property. CVE-2026-76560 permits an anonymous LDAP client to bypass SELFDN ACI bind-rule checks using an empty bind DN. These vulnerabilities affect Red Hat Enterprise Linux Server 7 Extended Lifecycle Support across multiple architectures. The update fixes these security issues and also resolves a replication initialization bug.

Successful exploitation of these vulnerabilities could lead to denial of service via crashes (NULL pointer dereference), privilege escalation to Directory Manager, bypass of access control checks by anonymous users, and potential memory corruption from buffer overflow. These impacts are critical as they affect authentication, authorization, and stability of the LDAP directory server, potentially compromising directory data and server integrity.

Red Hat has released an official security update for 389-ds-base in Red Hat Enterprise Linux 7 Extended Lifecycle Support that addresses all listed vulnerabilities. Users should apply the update as detailed in the Red Hat advisory (RHSA-2026:64771) and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided patch.