Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

This advisory covers five critical vulnerabilities in Red Hat Directory Server's 389-ds-base component: CVE-2026-18355 is a heap buffer overflow caused by SASL wrapped-record length underflow in sasl_io_start_packet(); CVE-2026-18453 is a pre-authentication NULL pointer dereference triggered via paged results and USE_ONE_BACKEND control in op_shared_search; CVE-2026-18922 allows privilege escalation to Directory Manager through stale identity in Cyrus SASL auxiliary property during SASL PLAIN authentication; CVE-2026-19843 is a command injection vulnerability via unescaped LDAP DN in the Cockpit 389 Console LDAP editor; CVE-2026-76560 enables an anonymous LDAP client to bypass SELFDN ACI bind-rule checks using an empty bind DN. Red Hat has issued a security update for Red Hat Directory Server 11.7 on RHEL 8.8 to fix these issues.

The vulnerabilities collectively allow attackers to cause denial of service via crashes, escalate privileges to Directory Manager, execute arbitrary commands through LDAP editor injection, and bypass access control checks. This can compromise the confidentiality, integrity, and availability of the directory server and its data. The issues affect authentication, authorization, and input validation mechanisms within the 389-ds-base LDAP server component.

Red Hat has released an official security update for Red Hat Directory Server 11.7 on RHEL 8.8 that addresses all listed vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2026:64792 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are required beyond applying the vendor-provided patch.