Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-07T09:00:00 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-122

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.

Red Hat rates this issue as Important impact. After a successful SASL bind with integrity protection (SSF > 0), an authenticated remote attacker can send a crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv(). Up to roughly two megabytes of attacker-controlled data can overflow the buffer, reliably crashing ns-slapd on production builds. Exploitation requires a valid SASL-authenticated LDAP session, not Directory Manager access. Any user who can bind with SASL mechanisms such as GSSAPI/Kerberos or DIGEST-MD5 can trigger the denial of service. In deployments where domain users, enrolled hosts, and service accounts routinely authenticate to the directory over Kerberos, the attack surface includes any such principal with network access to LDAP. This flaw is independent of CVE-2025-14905, which patched a separate heap overflow in schema.c and did not modify sasl_io.c. This issue was discovered by Ian Murphy (Red Hat). There is no complete workaround for this flaw. Mitigations that reduce exposure: 1. Restrict network access to LDAP ports (389/636) to trusted networks only. Note: In FreeIPA/IdM deployments, enrolled clients require LDAP access and this may not be practical. 2. If DIGEST-MD5 is not required, disable it via nsslapd-allowed-sasl-mechanisms in cn=config. GSSAPI/Kerberos cannot be disabled in FreeIPA/IdM without breaking domain authentication. 3. Monitor for oversized LDAP UNBIND packets (standard UNBIND is 7 bytes; alert on UNBIND packets exceeding ~100 bytes). 4. Lowering nsslapd-maxbersize reduces maximum overflow size but does not eliminate the vulnerability. Red Hat Directory Server 11.5 E4S for RHEL 8 2026-07-07T00:00:00Z RHSA-2026:36204 redhat-ds:11-8060020260702180044.0ca98e7e Red Hat Directory Server 11.7 E4S for RHEL 8 2026-07-07T00:00:00Z RHSA-2026:36208 redhat-ds:11-8080020260702180836.f969626e Red Hat Directory Server 11.9 for RHEL 8 2026-07-07T00:00:00Z RHSA-2026:36200 redhat-ds:11-8100020260702145313.37ed7c03 Red Hat Directory Server 12.2 E4S for RHEL 9 2026-07-08T00:00:00Z RHSA-2026:36641 redhat-ds:12-9020020260703060155.1674d574 Red Hat Directory Server 12.4 E4S for RHEL 9 2026-07-07T00:00:00Z RHSA-2026:36209 redhat-ds:12-9040020260703055735.1674d574 Red Hat Enterprise Linux 10 2026-07-07T00:00:00Z RHSA-2026:36196 389-ds-base-0:3.2.0-8.el10_2 Red Hat Enterprise Linux 10.0 Extended Update Support 2026-07-08T00:00:00Z RHSA-2026:36670 389-ds-base-0:3.0.6-19.el10_0 Red Hat Enterprise Linux 7 Extended Lifecycle Support 2026-07-07T00:00:00Z RHSA-2026:36205 389-ds-base-0:1.3.11.1-13.el7_9 Red Hat Enterprise Linux 8 2026-07-07T00:00:00Z RHSA-2026:36201 389-ds:1.4-8100020260626120929.25e700aa Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 2026-07-07T00:00:00Z RHSA-2026:36206 389-ds:1.4-8040020260629123121.96015a92 Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 2026-07-07T00:00:00Z RHSA-2026:36206 389-ds:1.4-8040020260629123121.96015a92 Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 2026-07-07T00:00:00Z RHSA-2026:36202 389-ds:1.4-8060020260626130540.824efc52 Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 2026-07-07T00:00:00Z RHSA-2026:36202 389-ds:1.4-8060020260626130540.824efc52 Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-07-07T00:00:00Z RHSA-2026:36197 389-ds:1.4-8080020260630025241.6dbb3803 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-07-07T00:00:00Z RHSA-2026:36197 389-ds:1.4-8080020260630025241.6dbb3803 Red Hat Enterprise Linux 9 2026-07-07T00:00:00Z RHSA-2026:36195 389-ds-base-0:2.8.0-8.el9_8 Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2026-07-08T00:00:00Z RHSA-2026:36585 389-ds-base-0:2.2.4-19.el9_2 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-07-07T00:00:00Z RHSA-2026:36198 389-ds-base-0:2.4.5-26.el9_4 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-07-08T00:00:00Z RHSA-2026:36671 389-ds-base-0:2.6.1-22.el9_6 Red Hat Directory Server 13.2 2026-07-08T00:00:00Z RHSA-2026:36660 dirsrv/dirsrv-container-rhel10:1783452100 Red Hat Directory Server 12 Affected redhat-ds:12/389-ds-base Red Hat Directory Server 13 Not affected 389-ds-base Red Hat Enterprise Linux 6 Will not fix 389-ds-base https://www.cve.org/CVERecord?id=CVE-2026-11610 https://nvd.nist.gov/vuln/detail/CVE-2026-11610