Buffer overflow in 389ds 389-Ds-Base
CVE-2026-11610
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (39.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 40th percentile — 39.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- 389ds 389-Ds-Base — versions 1.3.2
- Red Hat Directory Server 11
- Red Hat Directory Server 11.5 E4s For Rhel 8 — versions 8060020260702180044.0ca98e7e
- Red Hat Directory Server 11.7 E4s For Rhel 8 — versions 8080020260702180836.f969626e
- Red Hat Directory Server 11.9 For Rhel 8 — versions 8100020260702145313.37ed7c03
- Red Hat Directory Server 12
- Red Hat Directory Server 12.2 E4s For Rhel 9 — versions 9020020260703060155.1674d574
- Red Hat Directory Server 12.4 E4s For Rhel 9 — versions 9040020260703055735.1674d574
- Red Hat Directory Server 13
- Red Hat Directory Server 13.2 — versions 1783452100
Weakness classification (CWE)
References
- access.redhat.com/security/cve/CVE-2026-11610 (vdb-entry)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking)
- access.redhat.com/errata/RHSA-2026:36197 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:36198 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:36204 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:36208 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:36201 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:36202 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:36205 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:36206 (vendor-advisory)
Frequently asked questions
- What is CVE-2026-11610?
- CVE-2026-11610 is a high-severity vulnerability in 389ds 389-Ds-Base, classified under Heap-based Buffer Overflow. CVSS score: 8.8/10. Published 2026-07-07.
- How severe is CVE-2026-11610?
- High severity. CVSS v3 base score is 8.8 out of 10.