Two heap buffer overflow vulnerabilities were identified in the 389 Directory Server's SASL handling. One involves a heap buffer overflow in sasl_io_recv() triggered by a padded SASL UNBIND (CVE-2026-11610). The other is an integer overflow in SASL packet length that bypasses size limits, leading to a heap buffer overflow (CVE-2026-11774). These issues affect Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. Red Hat has released security updates addressing these vulnerabilities.

Red Hat Security Advisory: 389-ds-base security update

Two heap buffer overflow vulnerabilities have been identified in the 389 Directory Server's SASL handling components. These include a heap buffer overflow via padded SASL UNBIND (CVE-2026-11610) and an integer overflow in SASL packet length that bypasses size limits leading to a heap buffer overflow (CVE-2026-11774). These issues affect the 389-ds-base package used in Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat has issued security updates to address these vulnerabilities.

CVE-2026-11610 is a heap buffer overflow vulnerability in the SASL I/O layer of the 389 Directory Server (389-ds-base) used in Red Hat Directory Server 13.2 container images. After a successful SASL bind with integrity protection, an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that overflows a 512-byte heap buffer, causing a denial of service by crashing the server. The vulnerability affects any user who can authenticate via SASL mechanisms such as GSSAPI/Kerberos or DIGEST-MD5. There is no complete workaround, but mitigations include restricting LDAP network access and disabling DIGEST-MD5 if not required. A fixed container image is available from Red Hat.

Red Hat Security Advisory: Red Hat Directory Server 13.2 container image update

Red Hat Directory Server 12.2 for RHEL 9.2 has security vulnerabilities involving heap buffer overflows triggered by malformed SASL packets. These include a heap buffer overflow in sasl_io_recv() via a padded SASL UNBIND (CVE-2026-11610) and an integer overflow in SASL packet length that bypasses size limits leading to a heap buffer overflow (CVE-2026-11774).

Red Hat Security Advisory: redhat-ds:12 security update

Two security vulnerabilities have been identified in the 389 Directory Server component of Red Hat Enterprise Linux 9.2. These include a heap buffer overflow triggered by a padded SASL UNBIND operation (CVE-2026-11610) and an integer overflow in SASL packet length that bypasses size limits leading to a heap buffer overflow (CVE-2026-11774). Both issues relate to the handling of SASL packets in the LDAP server. Red Hat has released security updates addressing these flaws in version 2.2.4-19.el9_2 of the 389-ds-base package.

Two security vulnerabilities affecting 389 Directory Server (389-ds-base) have been addressed in a Red Hat Enterprise Linux 8 update. The first is a heap buffer overflow in the sasl_io_recv() function triggered by a padded SASL UNBIND message (CVE-2026-11610). The second is an integer overflow in the SASL packet length that bypasses size limits and leads to a heap buffer overflow (CVE-2026-11774). These flaws could potentially be exploited to cause memory corruption. Red Hat has released an important security update to fix these issues.

Red Hat Security Advisory: 389-ds:1.4 security update

Two security vulnerabilities have been identified in the 389 Directory Server (389-ds) version 1.4 used in Red Hat Enterprise Linux 8.6. These include a heap buffer overflow triggered by a padded SASL UNBIND message (CVE-2026-11610) and an integer overflow in SASL packet length that bypasses size limits leading to a heap buffer overflow (CVE-2026-11774). Both vulnerabilities could potentially allow an attacker to cause memory corruption.

Two security vulnerabilities have been identified in the 389 Directory Server (389-ds-base) used in Red Hat Enterprise Linux 7 Extended Lifecycle Support. These include a heap buffer overflow triggered by a padded SASL UNBIND message (CVE-2026-11610) and an integer overflow in SASL packet length that bypasses size limits, also leading to a heap buffer overflow (CVE-2026-11774). These issues affect the LDAP server component and could potentially be exploited to cause memory corruption.

Two security vulnerabilities have been identified in the 389 Directory Server (389-ds-base), an LDAPv3 compliant server used in Red Hat Enterprise Linux 10. These include a heap buffer overflow triggered by a padded SASL UNBIND operation (CVE-2026-11610) and an integer overflow in SASL packet length that bypasses size limits leading to a heap buffer overflow (CVE-2026-11774). Red Hat has released security updates addressing these issues in version 3.2.0-8.el10_2 of 389-ds-base. The vulnerabilities are rated with an important security impact by Red Hat Product Security. No public exploit code or exploitation in the wild has been reported.

Two security vulnerabilities have been identified in the 389 Directory Server (389-ds-base) used in Red Hat Enterprise Linux 9. These include a heap buffer overflow triggered via padded SASL UNBIND messages (CVE-2026-11610) and an integer overflow in SASL packet length that bypasses size limits, also leading to a heap buffer overflow (CVE-2026-11774). Both flaws could potentially allow attackers to cause memory corruption. Red Hat has released security updates addressing these issues for multiple architectures and variants of Red Hat Enterprise Linux 9.

Two heap buffer overflow vulnerabilities were discovered in the 389 Directory Server's SASL handling, specifically in sasl_io_recv() via padded SASL UNBIND and due to an integer overflow in SASL packet length. These flaws could lead to memory corruption in affected versions of the 389-ds-base package. Red Hat has issued security updates to address these issues in Red Hat Enterprise Linux 8.4 variants.

Red Hat Directory Server 389-ds-base contains heap buffer overflow vulnerabilities related to SASL packet processing. These vulnerabilities affect Red Hat Enterprise Linux 9 and related CodeReady Linux Builder variants on multiple architectures including x86_64, s390x, ppc64le, and aarch64. The issues are due to a heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610) and an integer overflow in SASL packet length that bypasses size limits leading to a heap buffer overflow (CVE-2026-11774).

Red Hat Security Advisory: redhat-ds:11 security update

Red Hat Directory Server 12 for RHEL 9.4 contains two security vulnerabilities involving heap buffer overflows triggered by malformed SASL packets. These include a heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610) and an integer overflow in SASL packet length that bypasses size limits leading to a heap buffer overflow (CVE-2026-11774). An update addressing these issues is available.

Two heap buffer overflow vulnerabilities were identified in the 389 Directory Server's SASL handling components. These include a heap buffer overflow in sasl_io_recv() triggered by a padded SASL UNBIND (CVE-2026-11610) and an integer overflow in SASL packet length that bypasses size limits leading to a heap buffer overflow (CVE-2026-11774). These issues affect Red Hat Enterprise Linux 9.4 and related packages. Red Hat has issued an important security advisory with updates addressing these vulnerabilities.

Red Hat Directory Server 11.5 E4S for RHEL 8 contains two security vulnerabilities in the 389-ds-base component. These include a heap buffer overflow triggered by a padded SASL UNBIND (CVE-2026-11610) and an integer overflow in SASL packet length that bypasses size limits leading to a heap buffer overflow (CVE-2026-11774). These issues have been addressed in a security update provided by Red Hat.

Red Hat Directory Server is an LDAPv3-compliant directory server. The image is maintained by Red Hat and updated regularly.
To pull this container image, run the following command: podman pull registry.redhat.io/dirsrv/dirsrv-container-rhel10:13.2

Red Hat Directory Server 11.9 for RHEL 8 received an important security update addressing two vulnerabilities: a heap buffer overflow in sasl_io_recv() triggered by padded SASL UNBIND, and an integer overflow in SASL packet length that bypasses size limits leading to a heap buffer overflow. These issues affect the 389-ds-base component of the directory server suite. The update fixes these vulnerabilities to prevent potential memory corruption.

389-ds-base

CVE-2026-11610 is a heap-based buffer overflow vulnerability in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection, an authenticated attacker can send an oversized LDAP UNBIND packet that overflows a 512-byte heap buffer, causing a denial of service (server crash). This flaw affects versions from 1.3.2 through 3.3.0 and has existed since approximately 2013. It is exploitable by any authenticated user with a valid Kerberos ticket or service account in FreeIPA and Red Hat Identity Management deployments. A security update fixing this issue is available from Red Hat.

Search: CVE-2026-11610