389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected |
|
||||||
| Red Hat | Red Hat Directory Server 13.2 | affected |
|
||||||
| Red Hat | Red Hat Directory Server 11 | affected | — | ||||||
| Red Hat | Red Hat Directory Server 12 | affected | — | ||||||
| Red Hat | Red Hat Directory Server 13 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 6 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 7 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 8 | affected | — |
No data.
No data.
No data available yet.
Vendor Workaround
To mitigate this issue, restrict network access to the 389-ds-base service to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the LDAP ports (typically 389 for LDAP and 636 for LDAPS) to known, authorized IP addresses or subnets. Example using `firewalld`: ```bash # firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_OR_SUBNET>" port port="389" protocol="tcp" accept' # firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_OR_SUBNET>" port port="636" protocol="tcp" accept' # firewall-cmd --reload ``` Replace `<TRUSTED_IP_OR_SUBNET>` with the actual IP addresses or network ranges of your trusted clients. This action may impact legitimate clients if not configured correctly. A service restart is not required for firewall changes to take effect.
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.778% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel Els
|
|
| CPEs | cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 |
cpe:/a:redhat:enterprise_linux:8 cpe:/o:redhat:rhel_els:6 cpe:/o:redhat:rhel_els:7 |
| Vendors & Products |
Redhat rhel Els
|
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:directory_server:13 |
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:directory_server:13.2::el10 | |
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/o:redhat:enterprise_linux:10.2 | |
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb |
|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server. | |
| Title | 389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos | |
| First Time appeared |
Redhat
Redhat directory Server Redhat enterprise Linux |
|
| Weaknesses | CWE-787 | |
| CPEs | cpe:/a:redhat:directory_server:11 cpe:/a:redhat:directory_server:12 cpe:/a:redhat:directory_server:13 cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9 |
|
| Vendors & Products |
Redhat
Redhat directory Server Redhat enterprise Linux |
|
| References |
| |
| Metrics |
cvssV3_1
|