CVE-2026-11610

389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Directory Server Directory Server E4s Enterprise Linux and 7 more

CVE-2024-3657

389-ds-base: potential denial of service via specially crafted kerberos as-req request

A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Redhat

Products

Directory Server Directory Server E4s Directory Server Eus and 3 more

CVE-2026-18922

389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Directory Server Directory Server E4s Enterprise Linux and 8 more

CVE-2008-0890

7.1: insecure default permissions on jars directory

Red Hat Directory Server 7.1 before SP4 uses insecure permissions for certain directories, which allows local users to modify JAR files and execute arbitrary code via unknown vectors.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Directory Server

CVE-2008-0892

Server: shell command injection in CGI replication monitor

The replication monitor CGI script (repl-monitor-cgi.pl) in Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and EL5, allows remote attackers to execute arbitrary commands.

CVSS 2.0 · 9.0 Critical EPSS 14.0% KEV · Not listed

Vendors

Redhat

Products

Directory Server Fedora Directory Server

CVE-2008-0893

Server: unrestricted access to CGI scripts

Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and EL5, does not properly restrict access to CGI scripts, which allows remote attackers to perform administrative actions.

CVSS 2.0 · 7.5 High EPSS 2.0% KEV · Not listed

Vendors

Redhat

Products

Directory Server

CVE-2008-1677

Server: insufficient buffer size for search patterns

Buffer overflow in the regular expression handler in Red Hat Directory Server 8.0 and 7.1 before SP6 allows remote attackers to cause a denial of service (slapd crash) and possibly execute arbitrary code via a crafted LDAP query that triggers the overflow during translation to a regular expression.

CVSS 2.0 · 7.5 High EPSS 4.9% KEV · Not listed

Vendors

Redhat

Products

Directory Server Fedora Directory Server

CVE-2008-2928

Server: CGI accept language buffer overflow

Multiple buffer overflows in the adminutil library in CGI applications in Red Hat Directory Server 7.1 before SP7 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted Accept-Language HTTP header.

CVSS 2.0 · 10.0 Critical EPSS 6.6% KEV · Not listed

Vendors

Redhat

Products

Directory Server

CVE-2008-2930

Server: temporary DoS via crafted pattern searches

Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 allow remote attackers to cause a denial of service (CPU consumption and search outage) via crafted LDAP search requests with patterns, related to a single-threaded regular-expression subsystem.

CVSS 2.0 · 7.1 High EPSS 6.6% KEV · Not listed

Vendors

Fedora Redhat

Products

Directory Server Directory Server

CVE-2008-2929

Server: multiple XSS issues

Multiple cross-site scripting (XSS) vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway (DSGW) web interface in Red Hat Directory Server 7.1 before SP7 and 8 EL4 and EL5, and Fedora Directory Server, allow remote attackers to inject arbitrary web script or HTML via input values that use % (percent) escaping.

CVSS 2.0 · 4.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Fedora Redhat

Products

Directory Server Directory Server

CVE-2008-3283

Server: multiple memory leaks

Multiple memory leaks in Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 and earlier allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) the authentication / bind phase and (2) anonymous LDAP search requests.

CVSS 2.0 · 7.8 High EPSS 2.9% KEV · Not listed

Vendors

Fedora Redhat

Products

Directory Server Directory Server

CVE-2008-0889

server: insecure permissions on fedora/redhat-idm-console

Red Hat Directory Server 8.0, when running on Red Hat Enterprise Linux, uses insecure permissions for the redhat-idm-console script, which allows local users to execute arbitrary code by modifying the script.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Directory Server Enterprise Linux

CVE-2006-0451

memory leaks using ber_scanf when handling bad BER packets (CVE-2006-0453)

Multiple memory leaks in the LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (memory consumption) via invalid BER packets that trigger an error, which might prevent memory from being freed if it was allocated during the ber_scanf call, as demonstrated using the ProtoVer LDAP test suite.

CVSS 2.0 · 5.0 Medium EPSS 1.6% KEV · Not listed

Vendors

Redhat

Products

Directory Server Fedora Core

CVE-2004-1236

security flaw

Buffer overflow in the LDAP component for Netscape Directory Server (NDS) 3.6 on HP-UX and other operating systems allows remote attackers to execute arbitrary code.

CVSS 2.0 · 10.0 Critical EPSS 8.9% KEV · Not listed

Vendors

Netscape Redhat

Products

Directory Server Directory Server

CVE-2006-0453

security flaw

The LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (crash) via a certain "bad BER sequence" that results in a free of uninitialized memory, as demonstrated using the ProtoVer LDAP test suite.

CVSS 2.0 · 7.8 High EPSS 1.9% KEV · Not listed

Vendors

Redhat

Products

Directory Server Fedora Core

CVE-2006-0452

recursion causes OOM with bad DN in dn2ancestor

dn2ancestor in the LDAP component in Fedora Directory Server 1.0 allows remote attackers to cause a denial of service (CPU and memory consumption) via a ModDN operation with a DN that contains a large number of "," (comma) characters, which results in a large amount of recursion, as demonstrated using the ProtoVer LDAP test suite.

CVSS 2.0 · 5.0 Medium EPSS 1.6% KEV · Not listed

Vendors

Redhat

Products

Directory Server Fedora Core

CVE-2020-1472

Netlogon Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

CVSS 3.1 · 5.5 Medium EPSS 99.4% KEV · Listed

Vendors

Canonical Debian Fedoraproject and 6 more

Products

Ubuntu Linux Debian Linux Fedora and 17 more

CVE-2022-2850

389-ds-base: SIGSEGV in sync_repl

A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Debian Fedoraproject Port389 and 1 more

Products

Debian Linux Fedora 389-ds-base and 3 more

CVE-2022-0918

389-ds-base: sending crafted message could result in DoS

A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection, no bind or other authentication is required. The message triggers a segmentation fault that results in slapd crashing.

CVSS 3.1 · 7.5 High EPSS 5.9% KEV · Not listed

Vendors

Port389 Redhat

Products

389-ds-base Directory Server Enterprise Linux and 1 more

CVE-2021-4091

389-ds-base: double free of the virtual attribute context in persistent search

A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed

Vendors

Port389 Redhat

Products

389-ds-base Directory Server Enterprise Linux and 8 more