Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

The Red Hat security advisory RHSA-2026:64781 addresses four critical vulnerabilities in 389-ds-base: CVE-2026-18355 is a heap buffer overflow caused by a SASL wrapped-record length lower-bound underflow in sasl_io_start_packet(); CVE-2026-18453 is a pre-authentication NULL pointer dereference triggered via paged results and USE_ONE_BACKEND control in op_shared_search; CVE-2026-18922 allows privilege escalation to Directory Manager through SASL PLAIN authentication due to a stale identity in the Cyrus SASL auxiliary property; CVE-2026-76560 enables an anonymous LDAP client to bypass SELFDN ACI bind-rule checks using an empty bind DN. These vulnerabilities affect Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and Extended Life Cycle variants. The advisory includes bug fixes related to replication and configuration. No CVSS scores are provided in the advisory, but the issues are rated critical by Red Hat.

Successful exploitation of these vulnerabilities could lead to denial of service via crashes (NULL pointer dereference), privilege escalation to Directory Manager (CVE-2026-18922), bypass of access control checks (CVE-2026-76560), and potential memory corruption or code execution due to heap buffer overflow (CVE-2026-18355). These impacts compromise the confidentiality, integrity, and availability of the LDAP directory service.

Red Hat has released updated 389-ds-base packages for Red Hat Enterprise Linux 9.4 and related variants that fix these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2026:64781 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are required beyond applying the official patch.