Summary
389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.
Security Fix(es):
* 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355)
* 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453)
* 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922)
* 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560)
* 389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS (CVE-2026-78701)
Bug Fix(es) and Enhancement(s):
* lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [almalinux-10.2.z] (JIRA:AlmaLinux-244470)
* fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [almalinux-10.2.z] (JIRA:AlmaLinux-248770)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | 389-ds-base | 3.2.0-10.el10_2 |
| AlmaLinux · 10 | 389-ds-base-bdb | 3.2.0-10.el10_2 |
| AlmaLinux · 10 | 389-ds-base-devel | 3.2.0-10.el10_2 |
| AlmaLinux · 10 | 389-ds-base-libs | 3.2.0-10.el10_2 |
| AlmaLinux · 10 | 389-ds-base-snmp | 3.2.0-10.el10_2 |
| AlmaLinux · 10 | python3-lib389 | 3.2.0-10.el10_2 |
Vulnerabilities 6
-
Critical 9.8
389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regard…
-
High 8.8
389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is co…
-
High 7.5
389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an upper bound. A small wire length (0, 1, or 2) produces an e…
-
High 7.5
389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search
A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACK…
-
High 7.5
389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to …
-
Medium 6.5
389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos
A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leadin…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-18355
-
report
https://access.redhat.com/security/cve/CVE-2026-18453
-
report
https://access.redhat.com/security/cve/CVE-2026-18922
-
report
https://access.redhat.com/security/cve/CVE-2026-76560
-
report
https://access.redhat.com/security/cve/CVE-2026-78701
-
report
https://bugzilla.redhat.com/2509186
-
report
https://bugzilla.redhat.com/2509696
-
report
https://bugzilla.redhat.com/2511388
-
report
https://bugzilla.redhat.com/2519521
-
report
https://bugzilla.redhat.com/2523232
-
advisory
https://errata.almalinux.org/10/ALSA-2026-64785.html