CVE-2026-11610 is a heap buffer overflow in the SASL I/O layer of 389 Directory Server (used by Red Hat Directory Server 13.2). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a fixed 512-byte heap buffer without bounds checking in sasl_io_recv() in sasl_io.c. This overflow can be up to approximately 2 megabytes of attacker-controlled data, causing a denial of service by crashing the ns-slapd process. The vulnerability affects any user able to authenticate via SASL mechanisms such as GSSAPI/Kerberos or DIGEST-MD5, including domain users, enrolled hosts, and service accounts in FreeIPA and Red Hat Identity Management deployments. The vulnerable code has existed since approximately 2013 and is independent of a previous heap overflow fixed in schema.c (CVE-2025-14905). No official patch is currently available. Mitigations include restricting LDAP port access to trusted networks, disabling DIGEST-MD5 if possible, monitoring for oversized LDAP UNBIND packets, and lowering the nsslapd-maxbersize parameter to reduce overflow size. The vulnerability is rated as important by Red Hat with a CVSS v3 base score of 8.8.

The vulnerability allows an authenticated attacker with a valid SASL session to cause a denial of service by crashing the directory server process via a heap buffer overflow. This impacts availability of the Red Hat Directory Server 13.2 LDAP service. The flaw does not require Directory Manager privileges but does require SASL authentication, which is commonly used in environments with Kerberos or DIGEST-MD5 authentication. There is no indication of remote code execution or data confidentiality/integrity compromise from this vulnerability as described. The attack surface includes any principal with network access to LDAP who can authenticate via SASL.

Red Hat has not released an official fix for this vulnerability yet. There is no complete workaround. Recommended mitigations are: 1) Restrict network access to LDAP ports (389/636) to trusted networks only, though this may not be practical in some deployments such as FreeIPA/IdM. 2) Disable DIGEST-MD5 SASL mechanism if it is not required. 3) Monitor LDAP traffic for oversized UNBIND packets (normal UNBIND packets are 7 bytes; alert on packets exceeding ~100 bytes). 4) Lower the nsslapd-maxbersize parameter to reduce the maximum overflow size, though this does not eliminate the vulnerability. Users should watch for updates from Red Hat for an official patch and apply it once available.