Critical Security Flaw in 389-ds-base Package: Heap Buffer Overflow and Integer Overflow Vulnerabilities
Summary
ALSA-2026:36195: Important: 389-ds-base security update. Affects 389-ds-base versions < 2.8.0-8.el9_8. Fixed in 2.8.0-8.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
389-ds-base is a robust LDAP version 3 compliant server that provides essential functionalities for directory services. It includes command-line utilities for server administration and is widely used in enterprise environments for managing user data and authentication. However, recent vulnerabilities have been identified that could compromise the security of systems utilizing this package.
Vulnerability Detail
The vulnerabilities stem from a heap buffer overflow in the sasl_io_recv() function due to a padded SASL UNBIND (CVE-2026-11610) and an integer overflow in the SASL packet length that bypasses size limits, leading to a heap buffer overflow (CVE-2026-11774). These vulnerabilities can allow an attacker to execute arbitrary code, potentially leading to unauthorized access and data breaches.
How To Fix
Minimum fixed version
2.8.0-8.el9_8
This is the first release that contains the fix.
sudo dnf update 389-ds-baseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit access to the LDAP server by configuring firewall rules to restrict incoming connections to trusted IP addresses only. This can help mitigate the risk of exploitation until the packages are updated.
Conclusion
In summary, the 389-ds-base package has critical vulnerabilities that need immediate attention. Users are advised to update to the latest patched version to mitigate risks. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for 389-ds-base →
FAQ
The vulnerabilities can lead to arbitrary code execution, allowing attackers to gain unauthorized access to sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
All versions prior to 2.8.0-8.el9_8 of the 389-ds-base package are affected by these vulnerabilities.
Yes, Vulert provides a service that monitors and alerts you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If immediate updates are not possible, implement firewall rules to restrict access to the LDAP server as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for 389-ds-base.
