Critical Security Flaws in 389-ds-base: Heap Buffer Overflow and Integer Overflow Vulnerabilities
Summary
ALSA-2026:36201: Important: 389-ds:1.4 security update. Affects 389-ds-base versions < 1.4.3.39-25.module_el8.10.0+4214+f26e0f43. Fixed in 1.4.3.39-25.module_el8.10.0+4214+f26e0f43. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
389 Directory Server is an LDAP version 3 (LDAPv3) compliant server that provides a robust framework for directory services. It includes essential components such as the LDAP server and command-line utilities for server administration. The server is widely used in enterprise environments for managing user information and access control. However, recent vulnerabilities have been identified that could compromise the integrity and security of the directory services.
Vulnerability Detail
The vulnerabilities stem from a heap buffer overflow in the sasl_io_recv() function due to padded SASL UNBIND (CVE-2026-11610) and an integer overflow in the SASL packet length that bypasses size limits, leading to a heap buffer overflow (CVE-2026-11774). These vulnerabilities could allow an attacker to execute arbitrary code, potentially leading to unauthorized access and data breaches.
How To Fix
Minimum fixed version
1.4.3.39-25.module_el8.10.0+4214+f26e0f43
This is the first release that contains the fix.
sudo dnf update 389-ds-baseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the 389 Directory Server and monitoring logs for any suspicious activity until the packages can be updated.
Conclusion
The identified vulnerabilities in the 389 Directory Server pose significant risks to security and data integrity. It is essential to apply the recommended updates promptly to mitigate these risks. Users should also consider utilizing tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for 389-ds-base →
FAQ
The vulnerabilities could lead to arbitrary code execution, allowing attackers to gain unauthorized access to sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
All versions prior to 1.4.3.39-25.module_el8.10.0+4214+f26e0f43 are affected by these vulnerabilities.
Yes, restricting access to the server and monitoring for unusual activity can help mitigate risks until the patch is applied.
Detailed information can be found on the CVE pages: CVE-2026-11610 and CVE-2026-11774.
Related vulnerabilities
Recent vulnerabilities recorded for 389-ds-base.
