Red Hat Security Advisory: redhat-ds:12 security, bug fix, and enhancement update

This advisory covers five critical security vulnerabilities in Red Hat Directory Server 12.2, specifically in the 389-ds-base package. CVE-2026-18355 is a heap buffer overflow caused by a SASL wrapped-record length lower-bound underflow in sasl_io_start_packet(). CVE-2026-18453 is a pre-authentication NULL pointer dereference triggered via paged results and USE_ONE_BACKEND control in op_shared_search. CVE-2026-18922 allows privilege escalation to Directory Manager through SASL PLAIN authentication due to a stale identity in the Cyrus SASL auxiliary property. CVE-2026-19843 is a command injection vulnerability via an unescaped LDAP DN in the Cockpit 389 Console LDAP editor. CVE-2026-76560 permits an anonymous LDAP client to bypass SELFDN ACI bind-rule checks using an empty bind DN. These vulnerabilities have been fixed in the updated 389-ds-base packages for Red Hat Directory Server 12.2 on RHEL 9.2.

The vulnerabilities can lead to critical impacts including heap buffer overflow potentially causing crashes or code execution, denial of service via NULL pointer dereference before authentication, privilege escalation to the Directory Manager account, command injection allowing arbitrary command execution, and bypass of access control checks allowing unauthorized LDAP operations. These impacts threaten the confidentiality, integrity, and availability of the directory server.

Red Hat has released updated packages for Red Hat Directory Server 12.2 on RHEL 9.2 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:64779 and the referenced article https://access.redhat.com/articles/11258. No alternative mitigations are stated; applying the official update is the recommended remediation.