Redhat Directory_server
39 CVEs affecting Redhat Directory_server. Latest disclosed: 2026-07-08. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9064 | High | 7.5 | 2026-05-20 | A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per L… |
CVE-2022-1949 | High | 7.5 | 2022-06-02 | An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can… |
CVE-2010-2222 | High | 7.5 | 2019-11-05 | The _ger_parse_control function in Red Hat Directory Server 8 and the 389 Directory Server allows attackers to cause a denial of service (NULL pointer derefere… |
CVE-2026-11611 | Medium | 6.5 | 2026-06-08 | A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stop… |
CVE-2024-6237 | Medium | 6.5 | 2024-07-09 | A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended sea… |
CVE-2022-2850 | Medium | 6.5 | 2022-10-14 | A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a special… |
CVE-2026-11788 | Medium | 5.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauth… |
CVE-2024-1062 | Medium | 5.5 | 2024-02-12 | A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr. |
CVE-2023-1055 | Medium | 5.5 | 2023-02-27 | A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which… |
CVE-2026-12528 | Medium | 5.4 | 2026-06-17 | A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trig… |
CVE-2026-14940 | Medium | 5.3 | 2026-07-07 | A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legacy-quoted value enc… |
CVE-2020-35518 | Medium | 5.3 | 2021-03-26 | When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthentica… |
CVE-2026-11791 | Medium | 5.0 | 2026-06-18 | A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function unconditionally frees attribute syntax information nodes, by… |
CVE-2026-11787 | Medium | 5.0 | 2026-06-09 | A flaw was found in 389 Directory Server. The ldap_utf8prev() function reads bytes before the start of a buffer without bounds checking, causing a heap buffer… |
CVE-2026-11790 | Medium | 4.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from store… |
CVE-2026-11789 | Medium | 4.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a crafted passwo… |
CVE-2026-14969 | Medium | 4.4 | 2026-07-07 | A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations… |
CVE-2026-11785 | Medium | 4.3 | 2026-06-09 | A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed… |
CVE-2026-15041 | Low | 3.7 | 2026-07-08 | A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a co… |
CVE-2010-3282 | Low | 3.3 | 2020-01-09 | 389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is enabled, logs the Di… |