CVE-2026-11610
HighA heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base).
Published Jul 7, 2026 · Updated Sep 29, 2026 · Also known as DEBIAN-CVE-2026-11610, EUVD-2026-42026, GHSA-2g8g-f92j-g4gq, UBUNTU-CVE-2026-11610
Key Facts
Patch in the next maintenance window- CVE-2026-11610 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting 11.9 (Directory Server), 13.2 (Directory Server), 11.5 (Directory Server E4s) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 0.5% probability of exploitation in the next 30 days.
- Fixed versions are available, including 389-ds 2.2.10~git255.752643c78-150500.3.48.1, 389-ds 2.2.10~git255.752643c78-150600.8.32.1, 389-ds 2.7.0~git212.9b0755edb-150700.3.19.1.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
0.5%
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-11610 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.
Affected Products
143 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| 11.9Directory Server | See advisory | n/a |
| 13.2Directory Server | See advisory | n/a |
| 11.5Directory Server E4s | See advisory | n/a |
| 11.7Directory Server E4s | See advisory | n/a |
| 12.2Directory Server E4s | See advisory | n/a |
Patched Releases
389-ds
2.2.10~git255.752643c78-150500.3.48.1, 2.2.10~git255.752643c78-150600.8.32.1, 2.7.0~git212.9b0755edb-150700.3.19.1, 3.0.6~git382.7a51ea5f5-160000.1.1, 3.2.2+4b41542b2-1.1
389-ds-base
0:1.3.11.1-13.el7_9, 0:2.4.5-26.el9_4, 0:3.2.0-8.el10_2, 1.3.10.2-17.amzn2.0.8, 1.3.11.1-5.0.11.el7_9, 1.4.3.39-25.module_el8.10.0+4214+f26e0f43, 1.4.3.39-25.module+el8.10.0+40233+16963435, 1.4.3.39-25.module+el8.10.0+90949+c5bfd23c, 2.8.0-8.el9_8, 3.2.0-8.el10_2, 3.3.1-1
389-ds-base-bdb
3.2.0-8.el10_2
389-ds-base-devel
1.3.10.2-17.amzn2.0.8, 1.3.11.1-5.0.11.el7_9, 1.4.3.39-25.module+el8.10.0+90949+c5bfd23c, 2.8.0-8.el9_8, 3.2.0-8.el10_2
389-ds-base-legacy-tools
1.4.3.39-25.module+el8.10.0+90949+c5bfd23c
389-ds-base-libs
1.3.10.2-17.amzn2.0.8, 1.3.11.1-5.0.11.el7_9, 1.4.3.39-25.module+el8.10.0+90949+c5bfd23c, 2.8.0-8.el9_8, 3.2.0-8.el10_2
389-ds-base-snmp
1.3.10.2-17.amzn2.0.8, 1.3.11.1-5.0.11.el7_9, 1.4.3.39-25.module+el8.10.0+90949+c5bfd23c, 2.8.0-8.el9_8, 3.2.0-8.el10_2
389-ds-devel
2.2.10~git255.752643c78-150500.3.48.1, 2.2.10~git255.752643c78-150600.8.32.1, 2.7.0~git212.9b0755edb-150700.3.19.1, 3.0.6~git382.7a51ea5f5-160000.1.1, 3.2.2+4b41542b2-1.1
389-ds-snmp
3.0.6~git382.7a51ea5f5-160000.1.1, 3.2.2+4b41542b2-1.1
389-ds:1.4
8100020260626120929.25e700aa
lib389
2.2.10~git255.752643c78-150500.3.48.1, 2.2.10~git255.752643c78-150600.8.32.1, 2.7.0~git212.9b0755edb-150700.3.19.1, 3.0.6~git382.7a51ea5f5-160000.1.1, 3.2.2+4b41542b2-1.1
libsvrcore0
2.2.10~git255.752643c78-150500.3.48.1, 2.2.10~git255.752643c78-150600.8.32.1, 2.7.0~git212.9b0755edb-150700.3.19.1, 3.0.6~git382.7a51ea5f5-160000.1.1, 3.2.2+4b41542b2-1.1
python3-lib389
1.4.3.39-25.module+el8.10.0+90949+c5bfd23c, 2.8.0-8.el9_8, 3.2.0-8.el10_2
redhat-ds:11
8080020260702180836.f969626e
redhat-ds:12
9020020260703060155.1674d574
Timeline
Publicly disclosed
Jul 7, 2026
Last updated
Sep 29, 2026
Weakness Type
- CWE-122 Heap-based Buffer Overflow
References
- advisoryRHSA-2026:36197
- advisoryRHSA-2026:36198
- advisoryRHSA-2026:36201
- advisoryRHSA-2026:36202
- advisoryRHSA-2026:36204
FAQ
Common Questions.
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base).
Affected: 11.9 (Directory Server); 13.2 (Directory Server); 11.5 (Directory Server E4s), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including 389-ds 2.2.10~git255.752643c78-150500.3.48.1, 389-ds 2.2.10~git255.752643c78-150600.8.32.1, 389-ds 2.7.0~git212.9b0755edb-150700.3.19.1.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2026-11610 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo