CVE-2026-11785

These are all security issues fixed in the 389-ds-3.2.2+4b41542b2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for 389-ds fixes the following issues:

Update to version 3.0.6~git382.7a51ea5f5.

Security issues fixed:

• CVE-2026-11610: heap buffer overflow in the SASL I/O layer via a crafted oversized LDAP UNBIND packet (bsc#1270695).
• CVE-2026-11611: unbounded memory growth allowed by the Content Synchronization persistent search plugin when an authenticated client stops reading sync responses (bsc#1267975).
• CVE-2026-11774: integer overflow in the SASL I/O layer leading to heap buffer overflow via crafted SASL packet length prefixes (bsc#1268298).
• CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure in LDAP responses to authenticated users (bsc#1268065).
• CVE-2026-11786: out-of-bounds read in the LDIF parser when processing attribute types with trailing semicolons during database import (bsc#1268064).
• CVE-2026-11787: heap buffer overread due to missing checks in string filter parsing (bsc#1268062).
• CVE-2026-11788: server crash due to missing allocation failure checks in the dereference control plugin (bsc#1268057).
• CVE-2026-11789: integer underflow in the SMD5 password storage plugin leading to a buffer overflow via a crafted password hash (bsc#1268058).
• CVE-2026-11790: excessive CPU consumption during authentication due to improper upper bounds enforcement in the PBKDF2-SHA256 password storage plugin (bsc#1268060).
• CVE-2026-11791: use-after-free in the schema reload mechanism can be triggered while concurrent LDAP query traffic is active (bsc#1268047).
• CVE-2026-11792: heap buffer overflow when audit logging is enabled and short cleartext passwords are logged (bsc#1268046).
• CVE-2026-11793: stack buffer overflow leading to crash via crafted credentials with an oversized algorithm ID (bsc#1268041).
• CVE-2026-11884: heap buffer overflow leading to crash when serializing objectclass definitions (bsc#1268115).
• CVE-2026-12528: heap buffer overflow during ACI parsing via malformed ACI strings (bsc#1268491).

Other updates and bugfixes:

• Version 3.0.6~git382.7a51ea5f5:
  • Issue 7711 - Fix typo in accountpolicy --login-history-size help text (#7713)
  • Issue 7688 - BUG - partial address leak in sso token (#7689)
  • Issue 7705 - With memberOfEntryScope set, deferred memberOf skips MODIFY operations (#7706)
  • Issue 7698 - Fix silent entry loss in LMDB bulk import waiter handling (#7699)
  • Issue 7666 - Replication performance degradation during total init on high-latency storage (#7667)
  • Issue 7201 - Syscall overhead in LMDB import writer thread (#7204)
  • Issue 7645 - Add runtime LeakSanitizer leak check (#7646)
  • Issue 7714 - UI - sass import rules are deprecated
  • Issue 7658 - Heap Buffer Overflow in sasl_io_recv() via Padded SASL UNBIND
  • Issue 7710 - MemberOf deferred update - Use condvar instead of sleep loop
  • Issue 7637 - UI - Using Arrow Keys in New Object Wizard Resulted in DOM Reload
  • Issue 7578 - schema - attribute refcount is not maintained properly
  • Issue 7605 - Harden CI test ports against ephemeral allocation (#7692)
  • Issue 7528 - Retry the CI image pull instead of failing the job (#7691)
  • Backport Issue 7519 -- ignore obsolete entrydn when entryrdn is in use (#7657)
  • Issue 7460 - MOD_REPLACE on groups/link attributes modifies overlap targets (#7461)
  • Issue 7505 - RFE - CLI - add feature to determine which password policy applies to a user
  • Issue 7670 - BDB range searches intermittently fail with err=1 under write load (#7671)
  • Issue 7108 - Fix shutdown crash in entry cache destruction (#7163)
  • Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7662)
  • Issue 7284 - Automated test for creating local password policy with incorrect passwordInHistory value (#7608)
  • Issue 7200 - repl-agmt create doesn't set some parameters (#7663)
  • Issue 7573 - Post-import cache autotuning does not recompute entry cache size (#7574)

-…

This update for 389-ds fixes the following issues:

Update to version 3.0.6~git382.7a51ea5f5.

Security issues fixed:

• CVE-2026-11610: heap buffer overflow in the SASL I/O layer via a crafted oversized LDAP UNBIND packet (bsc#1270695).
• CVE-2026-11611: unbounded memory growth allowed by the Content Synchronization persistent search plugin when an authenticated client stops reading sync responses (bsc#1267975).
• CVE-2026-11774: integer overflow in the SASL I/O layer leading to heap buffer overflow via crafted SASL packet length prefixes (bsc#1268298).
• CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure in LDAP responses to authenticated users (bsc#1268065).
• CVE-2026-11786: out-of-bounds read in the LDIF parser when processing attribute types with trailing semicolons during database import (bsc#1268064).
• CVE-2026-11787: heap buffer overread due to missing checks in string filter parsing (bsc#1268062).
• CVE-2026-11788: server crash due to missing allocation failure checks in the dereference control plugin (bsc#1268057).
• CVE-2026-11789: integer underflow in the SMD5 password storage plugin leading to a buffer overflow via a crafted password hash (bsc#1268058).
• CVE-2026-11790: excessive CPU consumption during authentication due to improper upper bounds enforcement in the PBKDF2-SHA256 password storage plugin (bsc#1268060).
• CVE-2026-11791: use-after-free in the schema reload mechanism can be triggered while concurrent LDAP query traffic is active (bsc#1268047).
• CVE-2026-11792: heap buffer overflow when audit logging is enabled and short cleartext passwords are logged (bsc#1268046).
• CVE-2026-11793: stack buffer overflow leading to crash via crafted credentials with an oversized algorithm ID (bsc#1268041).
• CVE-2026-11884: heap buffer overflow leading to crash when serializing objectclass definitions (bsc#1268115).
• CVE-2026-12528: heap buffer overflow during ACI parsing via malformed ACI strings (bsc#1268491).

Other updates and bugfixes:

• Version 3.0.6~git382.7a51ea5f5:
  • Issue 7711 - Fix typo in accountpolicy --login-history-size help text (#7713)
  • Issue 7688 - BUG - partial address leak in sso token (#7689)
  • Issue 7705 - With memberOfEntryScope set, deferred memberOf skips MODIFY operations (#7706)
  • Issue 7698 - Fix silent entry loss in LMDB bulk import waiter handling (#7699)
  • Issue 7666 - Replication performance degradation during total init on high-latency storage (#7667)
  • Issue 7201 - Syscall overhead in LMDB import writer thread (#7204)
  • Issue 7645 - Add runtime LeakSanitizer leak check (#7646)
  • Issue 7714 - UI - sass import rules are deprecated
  • Issue 7658 - Heap Buffer Overflow in sasl_io_recv() via Padded SASL UNBIND
  • Issue 7710 - MemberOf deferred update - Use condvar instead of sleep loop
  • Issue 7637 - UI - Using Arrow Keys in New Object Wizard Resulted in DOM Reload
  • Issue 7578 - schema - attribute refcount is not maintained properly
  • Issue 7605 - Harden CI test ports against ephemeral allocation (#7692)
  • Issue 7528 - Retry the CI image pull instead of failing the job (#7691)
  • Backport Issue 7519 -- ignore obsolete entrydn when entryrdn is in use (#7657)
  • Issue 7460 - MOD_REPLACE on groups/link attributes modifies overlap targets (#7461)
  • Issue 7505 - RFE - CLI - add feature to determine which password policy applies to a user
  • Issue 7670 - BDB range searches intermittently fail with err=1 under write load (#7671)
  • Issue 7108 - Fix shutdown crash in entry cache destruction (#7163)
  • Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7662)
  • Issue 7284 - Automated test for creating local password policy with incorrect passwordInHistory value (#7608)
  • Issue 7200 - repl-agmt create doesn't set some parameters (#7663)
  • Issue 7573 - Post-import cache autotuning does not recompute entry cache size (#7574)

-…

This update for 389-ds fixes the following issues:

Update to version 2.2.10~git255.752643c78.

Security issues fixed:

• CVE-2026-11610: missing bounds check in sasl_io_recv() can lead to a heap buffer overflow when processing a specially crafted oversized LDAP UNBIND packet (bsc#1270695).
• CVE-2026-11611: Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses(bsc#1267975).
• CVE-2026-11774: integer overflow in sasl_io_start_packet() can lead to heap buffer overflow when processing a crafted SASL packet length prefix (bsc#1268298).
• CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure in LDA responses (bsc#1268065).
• CVE-2026-11786: out-of-bounds read in the LDIF parser when processing attribute types with trailing semicolons during database import (bsc#1268064).
• CVE-2026-11787: missing bounds check in the ldap_utf8prev() functioncan can lead to a heap buffer overread in string filter parsing(bsc#1268062).
• CVE-2026-11788: missing allocation check in the dereference control plugin before using a BER structure can lead to LDAP server crash when the system is under memory pressure (bsc#1268057).
• CVE-2026-11789: integer underflow in the SMD5 password storage plugin can lead to a buffer overread when computing salt length from a crafted password hash shorter than 16 bytes (bsc#1268058).
• CVE-2026-11790: improper bounds enforcement in the BKDF2-SHA256 password storage plugin can lead to excessive resource consumption during authentication and cause a DoS (bsc#1268060).
• CVE-2026-11791: use-after-free in the schema reload mechanism can lead to a ns-slapd crash when concurrent LDAP query traffic is active (bsc#1268047).
• CVE-2026-11792: missing checks in create_masked_entry_string can lead to a heap and log output corruption whe a short cleartext password is logged (bsc#1268046).
• CVE-2026-11793: missing bounds check in checkPrefix() can lead to a stack buffer overflow when processing an algorithm ID during parsing of reversible-encrypted attribute values (bsc#1268041).
• CVE-2026-11884: improper string management can lead to heap buffer overflow when serializing objectclass definitions (bsc#1268115).
• CVE-2026-12528: missing length checks in the __aclp__normalize_acltxt() function can lead to heap buffer overflow when processing a malformed ACI string (bsc#1268491).

Other updates and bugfixes:

• Version 2.2.10~git255.752643c78.
  • Issue 7406 - Fix ldap-agent SNMP stats file loading (#7630)
  • Issue 7621 - Stack Buffer Overflow in Password checkPrefix
  • Issue 7623 - Heap Buffer Overflow in 389-ds-base Audit Log Password Masking
  • Issue 6625 - Backport get_pid to fix check_asan_report (#7625)
  • Issue 7602 - CI - lib389 user compare fails due to parentid mismatch (#7603)
  • Issue 7537 - CI - Fix replication log monitoring parser/timing failures (#7592)
  • Issue 7593 - Fix testimony docstring for SASL overflow test (#7606)
  • Issue 7530 - CI - Stabilize DNA plugin replication tests timing out in CI (#7572)
  • Issue 7593 - Reject invalid SASL packet length values in sasl_io_start_packet (#7594)
  • Issue 3555 - UI - Fix audit issue with npm - ws, js-yaml, js-yaml , postcss, uuid
  • Issue 7541 - Add invalid ACL text header regression test (#7591)
  • Issue 7541 - heap-buffer-overflows in __aclp__normalize_acltxt() (#7542)
  • Issue 7576 - Fix leak of temporary attribute syntax hash tables after schema reload
  • Issue 7558 - During online import, the IDL should be created with in-depth first approach (#7559)
  • Issue 7500 - Prevent unsigned integer underflow during stalled import
  • Issue 7560 - lib389 - Add helper function for checking ASAN files
  • Issue 7539 - Server shutdown during online reindex may lead to data loss (#7540)
  • Issue 7549 - Substring index should validate minimum…

This update for 389-ds fixes the following issues:

Update to version 2.2.10~git255.752643c78.

Security issues fixed:

• CVE-2026-11610: missing bounds check in sasl_io_recv() can lead to a heap buffer overflow when processing a specially crafted oversized LDAP UNBIND packet (bsc#1270695).
• CVE-2026-11611: Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses(bsc#1267975).
• CVE-2026-11774: integer overflow in sasl_io_start_packet() can lead to heap buffer overflow when processing a crafted SASL packet length prefix (bsc#1268298).
• CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure in LDA responses (bsc#1268065).
• CVE-2026-11786: out-of-bounds read in the LDIF parser when processing attribute types with trailing semicolons during database import (bsc#1268064).
• CVE-2026-11787: missing bounds check in the ldap_utf8prev() functioncan can lead to a heap buffer overread in string filter parsing(bsc#1268062).
• CVE-2026-11788: missing allocation check in the dereference control plugin before using a BER structure can lead to LDAP server crash when the system is under memory pressure (bsc#1268057).
• CVE-2026-11789: integer underflow in the SMD5 password storage plugin can lead to a buffer overread when computing salt length from a crafted password hash shorter than 16 bytes (bsc#1268058).
• CVE-2026-11790: improper bounds enforcement in the BKDF2-SHA256 password storage plugin can lead to excessive resource consumption during authentication and cause a DoS (bsc#1268060).
• CVE-2026-11791: use-after-free in the schema reload mechanism can lead to a ns-slapd crash when concurrent LDAP query traffic is active (bsc#1268047).
• CVE-2026-11792: missing checks in create_masked_entry_string can lead to a heap and log output corruption whe a short cleartext password is logged (bsc#1268046).
• CVE-2026-11793: missing bounds check in checkPrefix() can lead to a stack buffer overflow when processing an algorithm ID during parsing of reversible-encrypted attribute values (bsc#1268041).
• CVE-2026-11884: improper string management can lead to heap buffer overflow when serializing objectclass definitions (bsc#1268115).
• CVE-2026-12528: missing length checks in the __aclp__normalize_acltxt() function can lead to heap buffer overflow when processing a malformed ACI string (bsc#1268491).

Other updates and bugfixes:

• Version 2.2.10~git255.752643c78.
  • Issue 7406 - Fix ldap-agent SNMP stats file loading (#7630)
  • Issue 7621 - Stack Buffer Overflow in Password checkPrefix
  • Issue 7623 - Heap Buffer Overflow in 389-ds-base Audit Log Password Masking
  • Issue 6625 - Backport get_pid to fix check_asan_report (#7625)
  • Issue 7602 - CI - lib389 user compare fails due to parentid mismatch (#7603)
  • Issue 7537 - CI - Fix replication log monitoring parser/timing failures (#7592)
  • Issue 7593 - Fix testimony docstring for SASL overflow test (#7606)
  • Issue 7530 - CI - Stabilize DNA plugin replication tests timing out in CI (#7572)
  • Issue 7593 - Reject invalid SASL packet length values in sasl_io_start_packet (#7594)
  • Issue 3555 - UI - Fix audit issue with npm - ws, js-yaml, js-yaml , postcss, uuid
  • Issue 7541 - Add invalid ACL text header regression test (#7591)
  • Issue 7541 - heap-buffer-overflows in __aclp__normalize_acltxt() (#7542)
  • Issue 7576 - Fix leak of temporary attribute syntax hash tables after schema reload
  • Issue 7558 - During online import, the IDL should be created with in-depth first approach (#7559)
  • Issue 7500 - Prevent unsigned integer underflow during stalled import
  • Issue 7560 - lib389 - Add helper function for checking ASAN files
  • Issue 7539 - Server shutdown during online reindex may lead to data loss (#7540)
  • Issue 7549 - Substring index should validate minimum…

This update for 389-ds fixes the following issues

• Update to version 2.7.0~git212.9b0755edb.
• CVE-2026-11610: heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (bsc#1270695).
• CVE-2026-11611: content synchronization persistent search plugin can allow unbounded memory growth (bsc#1267975).
• CVE-2026-11774: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (bsc#1268298).
• CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure (bsc#1268065).
• CVE-2026-11786: lack of length check can cause an out-of-bounds read (bsc#1268064).
• CVE-2026-11787: lack of bounds check can lead to a heap buffer overread (bsc#1268062).
• CVE-2026-11788: lack of allocation failure check can lead to NULL pointer dereference (bsc#1268057).
• CVE-2026-11789: crafted SMD5 hash can lead to an integer underflow (bsc#1268058).
• CVE-2026-11790: crafted password hash can cause excessive CPU consumption (bsc#1268060).
• CVE-2026-11791: schema reload triggered during concurrent LDAP query traffic can lead to a use-after-free (bsc#1268047).
• CVE-2026-11792: password value shorter than 23 characters can cause a heap buffer overflow (bsc#1268046).
• CVE-2026-11793: crafted nsDS5ReplicaCredentials can lead to a stack buffer overflow (bsc#1268041).
• CVE-2026-11884: remote code execution and denial of service via heap buffer overflow (bsc#1268115).
• CVE-2026-12528: heap buffer overflows in __aclp__normalize_acltxt() (bsc#1268491).

This update for 389-ds fixes the following issues:

• CVE-2026-11774: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (bsc#1268298).
• CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure (bsc#1268065).
• CVE-2026-11786: lack of length check can cause an out-of-bound read (bsc#1268064).
• CVE-2026-11791: schema reload triggered during concurrent LDAP query traffic can lead to a use-after-free (bsc#1268047).

Changes for 389-ds:

• Update to version 2.7.0~git234.0afa2e38b:

• Issue 7711 - Fix typo in accountpolicy --login-history-size help text (#7713)
• Issue 7688 - BUG - partial address leak in sso token (#7689)
• Issue 7705 - With memberOfEntryScope set, deferred memberOf skips MODIFY operations (#7706)
• Issue 7714 - UI - sass import rules are deprecated
• Issue 7658 - Heap Buffer Overflow in sasl_io_recv() via Padded SASL UNBIND
• Issue 7710 - MemberOf deferred update - Use condvar instead of sleep loop
• Issue 7637 - fix cherry-pick error
• Issue 7637 - UI - Using Arrow Keys in New Object Wizard Resulted in DOM Reload
• Issue 7578 - schema - attribute refcount is not maintained properly
• Issue 7605 - Harden CI test ports against ephemeral allocation (#7692)
• Issue 7528 - Retry the CI image pull instead of failing the job (#7691)
• Issue 7460 - MOD_REPLACE on groups/link attributes modifies overlap targets (#7461)
• Issue 7670 - BDB range searches intermittently fail with err=1 under write load (#7671)
• Issue 7108 - Fix shutdown crash in entry cache destruction (#7163)
• Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7662)
• Issue 7284 - Automated test for creating local password policy with incorrect passwordInHistory value (#7608)
• Issue 7519 - Ignore obsolete entrydn index when entryrdn is enabled (#7526)
• Issue 7611 - Preserve legacy PBKDF2 hash compatibility (#7649)
• Issue 7547 - Heap buffer overflow in ldap_utf8prev()
• Issue 7611 - PBKDF2 password verification should reject invalid iteration count (#7613)
• Issue 7558 - Total init sends the suffix entry twice (#7640)
• Issue 7635 - Integer Underflow in {SMD5} Password Comparison (#7636)

This update for 389-ds fixes the following issues:

• CVE-2026-11774: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (bsc#1268298).
• CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure (bsc#1268065).
• CVE-2026-11786: lack of length check can cause an out-of-bound read (bsc#1268064).

Changes for 389-ds:

• Update to version 2.2.10~git272.fd28f95da:

• Issue 7688 - BUG - partial address leak in sso token (#7689)
• Issue 7711 - Fix typo in accountpolicy --login-history-size help text (#7713)
• Issue 7645 - Add runtime LeakSanitizer leak check (#7646)
• Issue 7658 - Heap Buffer Overflow in sasl_io_recv() via Padded SASL UNBIND
• Issue 7605 - Harden CI test ports against ephemeral allocation (#7692)
• Issue 7528 - Retry the CI image pull instead of failing the job (#7691)
• Issue 7460 - MOD_REPLACE on groups/link attributes modifies overlap targets (#7461)
• Issue 7670 - BDB range searches intermittently fail with err=1 under write load (#7671)
• Issue 7108 - Fix shutdown crash in entry cache destruction (#7163)
• Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7662)
• Issue 7284 - Automated test for creating local password policy with incorrect passwordInHistory value (#7608)
• Issue 7200 - repl-agmt create doesn't set some parameters (#7663)
• Issue 7611 - Preserve legacy PBKDF2 hash compatibility (#7649)
• Issue 7547 - Heap buffer overflow in ldap_utf8prev()
• Issue 7611 - PBKDF2 password verification should reject invalid iteration count (#7613)
• Issue 7558 - Total init sends the suffix entry twice (#7640)
• Issue 7635 - Integer Underflow in {SMD5} Password Comparison (#7636)

This update for 389-ds fixes the following issues:

• CVE-2026-11774: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (bsc#1268298).
• CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure (bsc#1268065).
• CVE-2026-11786: lack of length check can cause an out-of-bound read (bsc#1268064).

Changes for 389-ds:

• Update to version 2.2.10~git272.fd28f95da:

• Issue 7688 - BUG - partial address leak in sso token (#7689)
• Issue 7711 - Fix typo in accountpolicy --login-history-size help text (#7713)
• Issue 7645 - Add runtime LeakSanitizer leak check (#7646)
• Issue 7658 - Heap Buffer Overflow in sasl_io_recv() via Padded SASL UNBIND
• Issue 7605 - Harden CI test ports against ephemeral allocation (#7692)
• Issue 7528 - Retry the CI image pull instead of failing the job (#7691)
• Issue 7460 - MOD_REPLACE on groups/link attributes modifies overlap targets (#7461)
• Issue 7670 - BDB range searches intermittently fail with err=1 under write load (#7671)
• Issue 7108 - Fix shutdown crash in entry cache destruction (#7163)
• Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7662)
• Issue 7284 - Automated test for creating local password policy with incorrect passwordInHistory value (#7608)
• Issue 7200 - repl-agmt create doesn't set some parameters (#7663)
• Issue 7611 - Preserve legacy PBKDF2 hash compatibility (#7649)
• Issue 7547 - Heap buffer overflow in ldap_utf8prev()
• Issue 7611 - PBKDF2 password verification should reject invalid iteration count (#7613)
• Issue 7558 - Total init sends the suffix entry twice (#7640)
• Issue 7635 - Integer Underflow in {SMD5} Password Comparison (#7636)