A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server
(389-ds-base). After a successful SASL bind with integrity protection (SSF > 0),
an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet
that is copied into a 512-byte heap receive buffer without a bounds check in
sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of
attacker-controlled data to overflow the buffer, causing a denial of service (server
crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with
a valid Kerberos ticket, any enrolled host, or any service account can trigger this
vulnerability over the network after authenticating via GSSAPI.
The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and
was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow
in schema.c only.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Redhat |
|
No data.
No data.
References
History
Wed, 08 Jul 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 08 Jul 2026 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel Eus
|
|
| CPEs | cpe:/a:redhat:rhel_eus:9.6::appstream cpe:/a:redhat:rhel_eus:9.6::crb |
|
| Vendors & Products |
Redhat rhel Eus
|
|
| References |
|
Wed, 08 Jul 2026 12:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat enterprise Linux Eus
|
|
| CPEs | cpe:/a:redhat:directory_server_e4s:12.2::el9 cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Vendors & Products |
Redhat enterprise Linux Eus
|
|
| References |
|
Wed, 08 Jul 2026 11:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:directory_server:13.2::el10 | |
| References |
|
Wed, 08 Jul 2026 07:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:rhel_e4s:9.2::appstream | |
| References |
|
Tue, 07 Jul 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:9 |
cpe:/a:redhat:directory_server:11.9::el8 cpe:/a:redhat:directory_server_e4s:12.4::el9 cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb cpe:/o:redhat:enterprise_linux:10.2 |
| References |
|
Tue, 07 Jul 2026 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel Aus
Redhat rhel Els Redhat rhel Eus Long Life |
|
| CPEs | cpe:/o:redhat:enterprise_linux:8 |
cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream cpe:/o:redhat:rhel_els:7 |
| Vendors & Products |
Redhat rhel Aus
Redhat rhel Els Redhat rhel Eus Long Life |
|
| References |
|
Tue, 07 Jul 2026 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat directory Server E4s
Redhat rhel E4s Redhat rhel Tus |
|
| CPEs | cpe:/a:redhat:directory_server_e4s:11.5::el8 cpe:/a:redhat:directory_server_e4s:11.7::el8 cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_e4s:9.4::appstream cpe:/a:redhat:rhel_tus:8.8::appstream |
|
| Vendors & Products |
Redhat directory Server E4s
Redhat rhel E4s Redhat rhel Tus |
|
| References |
|
Tue, 07 Jul 2026 12:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Tue, 07 Jul 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only. | |
| Title | 389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind | |
| First Time appeared |
Redhat
Redhat directory Server Redhat enterprise Linux |
|
| Weaknesses | CWE-122 | |
| CPEs | cpe:/a:redhat:directory_server:11 cpe:/a:redhat:directory_server:12 cpe:/a:redhat:directory_server:13 cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9 |
|
| Vendors & Products |
Redhat
Redhat directory Server Redhat enterprise Linux |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: redhat
Published: 2026-07-07T09:17:36.519Z
Updated: 2026-07-08T21:02:28.863Z
Reserved: 2026-06-08T16:13:02.502Z
Link: CVE-2026-11610
Vulnrichment
Updated: 2026-07-08T21:02:25.086Z
NVD
No data.
Redhat