CVE-2026-11610389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind

Description

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.

Timeline

Scores

EPSS (exploitation in 30 days)

0.49% · top 58% of all CVEs (12 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Affected products

• 389ds · 389-ds-base

  • affected 1.3.2 – ≤ 3.3.0

• Red Hat · Red Hat Directory Server 11.5 E4S for RHEL 8

  • unaffected 8060020260702180044.0ca98e7e – < *

• Red Hat · Red Hat Directory Server 11.7 E4S for RHEL 8

  • unaffected 8080020260702180836.f969626e – < *

• Red Hat · Red Hat Directory Server 11.9 for RHEL 8

  • unaffected 8100020260702145313.37ed7c03 – < *

• Red Hat · Red Hat Directory Server 12.2 E4S for RHEL 9

  • unaffected 9020020260703060155.1674d574 – < *

• Red Hat · Red Hat Directory Server 12.4 E4S for RHEL 9

  • unaffected 9040020260703055735.1674d574 – < *

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 0:3.2.0-8.el10_2 – < *

• Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support

  • unaffected 0:3.0.6-19.el10_0 – < *

• Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Support

  • unaffected 0:1.3.11.1-13.el7_9 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 8100020260626120929.25e700aa – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

  • unaffected 8040020260629123121.96015a92 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

  • unaffected 8040020260629123121.96015a92 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

  • unaffected 8060020260626130540.824efc52 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

  • unaffected 8060020260626130540.824efc52 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service

  • unaffected 8080020260630025241.6dbb3803 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

  • unaffected 8080020260630025241.6dbb3803 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:2.8.0-8.el9_8 – < *

• Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

  • unaffected 0:2.2.4-19.el9_2 – < *

• Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

  • unaffected 0:2.4.5-26.el9_4 – < *

• Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Support

  • unaffected 0:2.6.1-22.el9_6 – < *

• Red Hat · Red Hat Directory Server 13.2

  • unaffected 1783452100 – < *

• Red Hat · Red Hat Directory Server 12

  All versions: affected

• Red Hat · Red Hat Directory Server 13

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 6

  All versions: affected

What to do

Workaround: There is no complete workaround for this flaw. Mitigations that reduce exposure: 1. Restrict network access to LDAP ports (389/636) to trusted networks only. Note: In FreeIPA/IdM deployments, enrolled clients require LDAP access and this may not be practical. 2. If DIGEST-MD5 is not required, disable it via nsslapd-allowed-sasl-mechanisms in cn=config. GSSAPI/Kerberos cannot be disabled in FreeIPA/IdM without breaking domain authentication. 3. Monitor for oversized LDAP UNBIND packets (standard UNBIND is 7 bytes; alert on UNBIND packets exceeding ~100 bytes). 4. Lowering nsslapd-maxbersize reduces maximum overflow size but does not eliminate the vulnerability.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-42026 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-11610](https://cveledger.app/badge/CVE-2026-11610.svg)](https://cveledger.app/cve/CVE-2026-11610)

Record last updated 4 Nov 2026, 21:50 UTC.