Skip to content
Fencer Vulns
high 8.8

CVE-2026-11610 json

389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind

published 2026-07-07 4 mo ago modified 2026-11-04 4 d ago also EUVD-2026-42026

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.

Patch / fix

  • Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 8060020260702180044.0ca98e7e
  • Red Hat Red Hat Directory Server 11.7 E4S for RHEL 8 8080020260702180836.f969626e
  • Red Hat Red Hat Directory Server 11.9 for RHEL 8 8100020260702145313.37ed7c03
  • Red Hat Red Hat Directory Server 12.2 E4S for RHEL 9 9020020260703060155.1674d574
  • Red Hat Red Hat Directory Server 12.4 E4S for RHEL 9 9040020260703055735.1674d574
  • Red Hat Red Hat Enterprise Linux 10 0:3.2.0-8.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.0.6-19.el10_0
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:1.3.11.1-13.el7_9
  • Red Hat Red Hat Enterprise Linux 8 8100020260626120929.25e700aa
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020260629123121.96015a92
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 8040020260629123121.96015a92
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020260626130540.824efc52
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 8060020260626130540.824efc52
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020260630025241.6dbb3803
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020260630025241.6dbb3803
  • Red Hat Red Hat Enterprise Linux 9 0:2.8.0-8.el9_8
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:2.2.4-19.el9_2
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:2.4.5-26.el9_4
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:2.6.1-22.el9_6
  • Red Hat Red Hat Directory Server 13.2 1783452100
  • 389-ds-base directory server 11.9 1.4.3.39-25.module+el8dsrv+24463+e272972e
  • cockpit-389-ds directory server 11.9 1.4.3.39-25.module+el8dsrv+24463+e272972e
  • python3-lib389 directory server 11.9 1.4.3.39-25.module+el8dsrv+24463+e272972e
  • 389-ds-base-libs directory server 11.9 1.4.3.39-25.module+el8dsrv+24463+e272972e
  • 389-ds-base-snmp directory server 11.9 1.4.3.39-25.module+el8dsrv+24463+e272972e
  • 389-ds-base-legacy-tools directory server 11.9 1.4.3.39-25.module+el8dsrv+24463+e272972e
  • 389-ds-base RHEL 8 1.4.3.39-25.module+el8.10.0+24462+1b66c107
  • python3-lib389 RHEL 8 1.4.3.39-25.module+el8.10.0+24462+1b66c107

red hat advisories RHSA-2026:36671RHSA-2026:36670RHSA-2026:36641RHSA-2026:36585RHSA-2026:36208RHSA-2026:36209

  • 389-ds SLES for SAP applications 16.0, SLES 16.0 3.0.6~git382.7a51ea5f5-160000.1.1
  • 389-ds SLE Module for Server Applications 15 SP7 2.7.0~git212.9b0755edb-150700.3.19.1
  • 389-ds SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 2.2.10~git255.752643c78-150500.3.48.1
  • 389-ds SLES for SAP 15 SP6, SLES 15 SP6-LTSS 2.2.10~git255.752643c78-150600.8.32.1

suse advisories SUSE-SU-2026:23574-1SUSE-SU-2026:3138-1SUSE-SU-2026:3137-1SUSE-SU-2026:3136-1

  • 389-ds openSUSE Leap 16.0 3.0.6~git382.7a51ea5f5-160000.1.1
  • 389-ds openSUSE Tumbleweed 3.2.2+4b41542b2-1.1

opensuse advisories openSUSE-SU-2026:21691-1openSUSE-SU-2026:11600-1

  • 389-ds-base AlmaLinux 9 2.8.0-10.el9_8
  • python3-lib389 AlmaLinux 9 2.8.0-10.el9_8
  • 389-ds-base-libs AlmaLinux 9 2.8.0-10.el9_8
  • 389-ds-base-snmp AlmaLinux 9 2.8.0-10.el9_8
  • 389-ds-base AlmaLinux 10 3.2.0-10.el10_2
  • python3-lib389 AlmaLinux 10 3.2.0-10.el10_2
  • 389-ds-base-bdb AlmaLinux 10 3.2.0-10.el10_2
  • 389-ds-base-libs AlmaLinux 10 3.2.0-10.el10_2

almalinux advisories ALSA-2026:64784ALSA-2026:64785ALSA-2026:36195ALSA-2026:36196ALSA-2026:36201

  • 389-ds-base Rocky Linux 8 1.4.3.39-25.module+el8.10.0+40233+16963435
  • 389-ds-base Rocky Linux 10 3.2.0-8.el10_2
  • 389-ds-base Rocky Linux 9 2.8.0-8.el9_8

rocky linux advisories RLSA-2026:36201RLSA-2026:36196RLSA-2026:36195

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-11610 updated cvss 8.8

389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND

  • Red Hat Directory Server 12 389-ds-base
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 6 389-ds-base, 389-ds-base-libs
    affected: workaround, no fix planned “Will not fix”
  • Red Hat CodeReady Linux Builder EUS (v.9.6) 389-ds-base-devel 2.6.1-22.el9_6, 389-ds-base-debuginfo 2.6.1-22.el9_6, 389-ds-base-debugsource 2.6.1-22.el9_6, 389-ds-base-libs-debuginfo 2.6.1-22.el9_6, 389-ds-base-snmp-debuginfo 2.6.1-22.el9_6
    fixed: vendor fix RHSA-2026:36671
  • Red Hat Directory Server 11.5 E4S for RHEL 8 389-ds-base 1.4.3.34-7.module+el8dsrv+24471+245dd8e2, cockpit-389-ds 1.4.3.34-7.module+el8dsrv+24471+245dd8e2, python3-lib389 1.4.3.34-7.module+el8dsrv+24471+245dd8e2, 389-ds-base-libs 1.4.3.34-7.module+el8dsrv+24471+245dd8e2, 389-ds-base-snmp 1.4.3.34-7.module+el8dsrv+24471+245dd8e2, 389-ds-base-legacy-tools 1.4.3.34-7.module+el8dsrv+24471+245dd8e2
    fixed: vendor fix RHSA-2026:36204
  • Red Hat Directory Server 11.7 E4S for RHEL 8 389-ds-base 1.4.3.34-16.module+el8dsrv+24461+e76d504b, cockpit-389-ds 1.4.3.34-16.module+el8dsrv+24461+e76d504b, python3-lib389 1.4.3.34-16.module+el8dsrv+24461+e76d504b, 389-ds-base-libs 1.4.3.34-16.module+el8dsrv+24461+e76d504b, 389-ds-base-snmp 1.4.3.34-16.module+el8dsrv+24461+e76d504b, 389-ds-base-legacy-tools 1.4.3.34-16.module+el8dsrv+24461+e76d504b
    fixed: vendor fix RHSA-2026:36208
  • Red Hat Directory Server 11.9 for RHEL 8 389-ds-base 1.4.3.39-25.module+el8dsrv+24463+e272972e, cockpit-389-ds 1.4.3.39-25.module+el8dsrv+24463+e272972e, python3-lib389 1.4.3.39-25.module+el8dsrv+24463+e272972e, 389-ds-base-libs 1.4.3.39-25.module+el8dsrv+24463+e272972e, 389-ds-base-snmp 1.4.3.39-25.module+el8dsrv+24463+e272972e, 389-ds-base-legacy-tools 1.4.3.39-25.module+el8dsrv+24463+e272972e
    fixed: vendor fix RHSA-2026:36200
  • Red Hat Directory Server 12.2 E4S for RHEL 9 389-ds-base 2.2.7-16.module+el9dsrv+24460+990bd826, cockpit-389-ds 2.2.7-16.module+el9dsrv+24460+990bd826, python3-lib389 2.2.7-16.module+el9dsrv+24460+990bd826, 389-ds-base-libs 2.2.7-16.module+el9dsrv+24460+990bd826, 389-ds-base-snmp 2.2.7-16.module+el9dsrv+24460+990bd826
    fixed: vendor fix RHSA-2026:36641
  • Red Hat Directory Server 12.4 E4S for RHEL 9 389-ds-base 2.4.5-24.module+el9dsrv+24459+87716c2d, cockpit-389-ds 2.4.5-24.module+el9dsrv+24459+87716c2d, python3-lib389 2.4.5-24.module+el9dsrv+24459+87716c2d, 389-ds-base-libs 2.4.5-24.module+el9dsrv+24459+87716c2d, 389-ds-base-snmp 2.4.5-24.module+el9dsrv+24459+87716c2d
    fixed: vendor fix RHSA-2026:36209
show 19 more
  • Red Hat Directory Server 13.2 dirsrv/dirsrv-container-rhel10 1783452100
    fixed: vendor fix RHSA-2026:36660
  • Red Hat Enterprise Linux AppStream (v. 8) 389-ds-base 1.4.3.39-25.module+el8.10.0+24462+1b66c107, python3-lib389 1.4.3.39-25.module+el8.10.0+24462+1b66c107, 389-ds-base-libs 1.4.3.39-25.module+el8.10.0+24462+1b66c107, 389-ds-base-snmp 1.4.3.39-25.module+el8.10.0+24462+1b66c107, 389-ds-base-legacy-tools 1.4.3.39-25.module+el8.10.0+24462+1b66c107
    fixed: vendor fix RHSA-2026:36201
  • Red Hat Enterprise Linux AppStream (v. 9) 389-ds-base 2.8.0-8.el9_8, python3-lib389 2.8.0-8.el9_8, 389-ds-base-libs 2.8.0-8.el9_8, 389-ds-base-snmp 2.8.0-8.el9_8
    fixed: vendor fix RHSA-2026:36195
  • Red Hat Enterprise Linux AppStream (v. 10) 389-ds-base 3.2.0-8.el10_2, python3-lib389 3.2.0-8.el10_2, 389-ds-base-libs 3.2.0-8.el10_2, 389-ds-base-snmp 3.2.0-8.el10_2
    fixed: vendor fix RHSA-2026:36196
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) 389-ds-base 1.4.3.34-5.module+el8.4.0+24472+7ce5ce41, python3-lib389 1.4.3.34-5.module+el8.4.0+24472+7ce5ce41, 389-ds-base-libs 1.4.3.34-5.module+el8.4.0+24472+7ce5ce41, 389-ds-base-snmp 1.4.3.34-5.module+el8.4.0+24472+7ce5ce41, 389-ds-base-legacy-tools 1.4.3.34-5.module+el8.4.0+24472+7ce5ce41
    fixed: vendor fix RHSA-2026:36206
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) 389-ds-base 1.4.3.34-10.module+el8.6.0+24464+c3b0cd7a, python3-lib389 1.4.3.34-10.module+el8.6.0+24464+c3b0cd7a, 389-ds-base-libs 1.4.3.34-10.module+el8.6.0+24464+c3b0cd7a, 389-ds-base-snmp 1.4.3.34-10.module+el8.6.0+24464+c3b0cd7a, 389-ds-base-legacy-tools 1.4.3.34-10.module+el8.6.0+24464+c3b0cd7a
    fixed: vendor fix RHSA-2026:36202
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) 389-ds-base 1.4.3.35-19.module+el8.8.0+24470+25f37233, python3-lib389 1.4.3.35-19.module+el8.8.0+24470+25f37233, 389-ds-base-libs 1.4.3.35-19.module+el8.8.0+24470+25f37233, 389-ds-base-snmp 1.4.3.35-19.module+el8.8.0+24470+25f37233, 389-ds-base-legacy-tools 1.4.3.35-19.module+el8.8.0+24470+25f37233
    fixed: vendor fix RHSA-2026:36197
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) 389-ds-base 2.2.4-19.el9_2, python3-lib389 2.2.4-19.el9_2, 389-ds-base-libs 2.2.4-19.el9_2
    fixed: vendor fix RHSA-2026:36585
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) 389-ds-base 2.4.5-26.el9_4, python3-lib389 2.4.5-26.el9_4, 389-ds-base-libs 2.4.5-26.el9_4
    fixed: vendor fix RHSA-2026:36198
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) 389-ds-base 3.0.6-19.el10_0, python3-lib389 3.0.6-19.el10_0, 389-ds-base-libs 3.0.6-19.el10_0, 389-ds-base-snmp 3.0.6-19.el10_0
    fixed: vendor fix RHSA-2026:36670
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) 389-ds-base 2.6.1-22.el9_6, python3-lib389 2.6.1-22.el9_6, 389-ds-base-libs 2.6.1-22.el9_6, 389-ds-base-snmp 2.6.1-22.el9_6
    fixed: vendor fix RHSA-2026:36671
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) 389-ds-base 1.4.3.34-5.module+el8.4.0+24472+7ce5ce41, python3-lib389 1.4.3.34-5.module+el8.4.0+24472+7ce5ce41, 389-ds-base-libs 1.4.3.34-5.module+el8.4.0+24472+7ce5ce41, 389-ds-base-snmp 1.4.3.34-5.module+el8.4.0+24472+7ce5ce41, 389-ds-base-legacy-tools 1.4.3.34-5.module+el8.4.0+24472+7ce5ce41
    fixed: vendor fix RHSA-2026:36206
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) 389-ds-base 1.4.3.34-10.module+el8.6.0+24464+c3b0cd7a, python3-lib389 1.4.3.34-10.module+el8.6.0+24464+c3b0cd7a, 389-ds-base-libs 1.4.3.34-10.module+el8.6.0+24464+c3b0cd7a, 389-ds-base-snmp 1.4.3.34-10.module+el8.6.0+24464+c3b0cd7a, 389-ds-base-legacy-tools 1.4.3.34-10.module+el8.6.0+24464+c3b0cd7a
    fixed: vendor fix RHSA-2026:36202
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) 389-ds-base 1.4.3.35-19.module+el8.8.0+24470+25f37233, python3-lib389 1.4.3.35-19.module+el8.8.0+24470+25f37233, 389-ds-base-libs 1.4.3.35-19.module+el8.8.0+24470+25f37233, 389-ds-base-snmp 1.4.3.35-19.module+el8.8.0+24470+25f37233, 389-ds-base-legacy-tools 1.4.3.35-19.module+el8.8.0+24470+25f37233
    fixed: vendor fix RHSA-2026:36197
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) 389-ds-base-devel 2.8.0-8.el9_8, 389-ds-base-debuginfo 2.8.0-8.el9_8, 389-ds-base-debugsource 2.8.0-8.el9_8, 389-ds-base-libs-debuginfo 2.8.0-8.el9_8, 389-ds-base-snmp-debuginfo 2.8.0-8.el9_8
    fixed: vendor fix RHSA-2026:36195
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) 389-ds-base-bdb 3.2.0-8.el10_2
    fixed: vendor fix RHSA-2026:36196
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) 389-ds-base-bdb 3.0.6-19.el10_0
    fixed: vendor fix RHSA-2026:36670
  • Red Hat Enterprise Linux Server (v. 7 ELS) 389-ds-base 1.3.11.1-13.el7_9, 389-ds-base-libs 1.3.11.1-13.el7_9 Red Hat Enterprise Linux Server Optional (v. 7 ELS) 389-ds-base 1.3.11.1-13.el7_9, 389-ds-base-libs 1.3.11.1-13.el7_9, 389-ds-base-snmp 1.3.11.1-13.el7_9
    fixed: vendor fix RHSA-2026:36205
  • Red Hat Directory Server 13 389-ds-base
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
4 mo ago

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • 389ds 389-ds-base
  • Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8
  • Red Hat Red Hat Directory Server 11.7 E4S for RHEL 8
  • Red Hat Red Hat Directory Server 11.9 for RHEL 8
  • Red Hat Red Hat Directory Server 12.2 E4S for RHEL 9
  • Red Hat Red Hat Directory Server 12.4 E4S for RHEL 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Directory Server 13.2
  • Red Hat Red Hat Directory Server 12
  • Red Hat Red Hat Directory Server 13
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness
  • CWE-122 Heap-based Buffer Overflow

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.