CVE-2026-18355

389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()

7.5 High

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an upper bound. A small wire length (0, 1, or 2) produces an encrypted_buffer_count below the already-consumed encrypted_buffer_offset, causing an unsigned subtraction underflow in sasl_io_read_packet(). PR_Recv is then requested to read approximately 4 GiB into a 1024-byte heap buffer, resulting in a heap buffer overflow with attacker-controlled content. After a successful SASL bind with integrity protection (SSF > 0), a remote authenticated attacker can cause a denial of service or potentially achieve remote code execution. This flaw is distinct from CVE-2026-11774, whose fix only guards against upper-bound overflow.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.84%Unchanged since Sep 8, 2026

What each source reports

CVE List Score used 7.5

389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()

Record: CVE-2026-18355
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-191
Updated: 2026-11-04

EUVDEUVD-2026-72455 7.5

Record: EUVD-2026-72455
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-04

GitHub AdvisoriesGHSA-r5vv-79fp-2427 7.5

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base)...

Record: GHSA-r5vv-79fp-2427
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-191
Updated: 2026-11-02

NVD 7.5

Record: CVE-2026-18355
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-191
Updated: 2026-11-04

OSVDEBIAN-CVE-2026-18355 7.5

Record: DEBIAN-CVE-2026-18355
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-05

OSVRHSA-2026:64771 9.8

Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

Record: RHSA-2026:64771
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 31 moreShow less

OSVRHSA-2026:64776 9.8

Red Hat Security Advisory: 389-ds:1.4 security, bug fix, and enhancement update

Record: RHSA-2026:64776
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:64778 9.8

Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

Record: RHSA-2026:64778
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:64779 9.8

Red Hat Security Advisory: redhat-ds:12 security, bug fix, and enhancement update

Record: RHSA-2026:64779
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:64780 9.8

Red Hat Security Advisory: redhat-ds:12 security, bug fix, and enhancement update

Record: RHSA-2026:64780
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:64781 9.8

Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

Record: RHSA-2026:64781
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:64783 9.8

Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

Record: RHSA-2026:64783
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:64784 9.8

Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

Record: RHSA-2026:64784
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:64785 9.8

Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

Record: RHSA-2026:64785
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:64789 9.8

Red Hat Security Advisory: 389-ds:1.4 security, bug fix, and enhancement update

Record: RHSA-2026:64789
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:64790 9.8

Red Hat Security Advisory: 389-ds:1.4 security, bug fix, and enhancement update

Record: RHSA-2026:64790
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:64791 9.8

Red Hat Security Advisory: 389-ds:1.4 security, bug fix, and enhancement update

Record: RHSA-2026:64791
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:64792 9.8

Red Hat Security Advisory: redhat-ds:11 security, bug fix, and enhancement update

Record: RHSA-2026:64792
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:64793 9.8

Red Hat Security Advisory: redhat-ds:11 security, bug fix, and enhancement update

Record: RHSA-2026:64793
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:64804 9.8

Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

Record: RHSA-2026:64804
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:79217 9.8

Red Hat Security Advisory: redhat-ds:11 security, bug fix, and enhancement update

Record: RHSA-2026:79217
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:64784 9.8

Critical: 389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355)
389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453)
389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922)
389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560)
389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS (CVE-2026-78701)

Bug Fix(es) and Enhancement(s):

lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [rhel-9.8.z] (JIRA:Rocky Linux-244467)
fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [rhel-9.8.z] (JIRA:Rocky Linux-248766)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:64784
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:64785 9.8

Critical: 389-ds-base security, bug fix, and enhancement update

Security Fix(es):

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355)
389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453)
389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922)
389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560)
389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS (CVE-2026-78701)

Bug Fix(es) and Enhancement(s):

lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [rhel-10.2.z] (JIRA:Rocky Linux-244470)
fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [rhel-10.2.z] (JIRA:Rocky Linux-248770)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:64785
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:64791 9.8

Critical: 389-ds:1.4 security, bug fix, and enhancement update

Security Fix(es):

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355)
389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453)
389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922)
389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560)

Bug Fix(es) and Enhancement(s):

lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [rhel-8.10.z] (JIRA:Rocky Linux-244463)
fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [rhel-8.10.z] (JIRA:Rocky Linux-248762)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:64791
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-18355 7.5

Record: UBUNTU-CVE-2026-18355
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVALSA-2026:64784 No score

Critical: 389-ds-base security, bug fix, and enhancement update

Security Fix(es):

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355)
389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453)
389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922)
389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560)
389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS (CVE-2026-78701)

Bug Fix(es) and Enhancement(s):

lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [almalinux-9.8.z] (JIRA:AlmaLinux-244467)
fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [almalinux-9.8.z] (JIRA:AlmaLinux-248766)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:64784
Updated: 2026-11-02

OSVALSA-2026:64785 No score

Critical: 389-ds-base security, bug fix, and enhancement update

Security Fix(es):

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355)
389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453)
389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922)
389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560)
389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS (CVE-2026-78701)

Bug Fix(es) and Enhancement(s):

lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [almalinux-10.2.z] (JIRA:AlmaLinux-244470)
fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [almalinux-10.2.z] (JIRA:AlmaLinux-248770)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:64785
Updated: 2026-11-02

OSVALSA-2026:64791 No score

Critical: 389-ds:1.4 security, bug fix, and enhancement update

Security Fix(es):

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355)
389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453)
389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922)
389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560)

Bug Fix(es) and Enhancement(s):

lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [almalinux-8.10.z] (JIRA:AlmaLinux-244463)
fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [almalinux-8.10.z] (JIRA:AlmaLinux-248762)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:64791
Updated: 2026-11-02

OSVAZL-99980 No score

CVE-2026-18355 affecting package 389-ds-base 3.1.1-12

Record: AZL-99980
Updated: 2026-11-05

OSVCLSA-2026-1789580964 No score

389-ds-base: Fix of 4 CVEs

CVE-2026-18922: reset the SASL auxprop context after a failed one-shot bind so a stale canon_user identity cannot be inherited by a later successful bind
CVE-2026-18355: validate the minimum SASL packet length in sasl_io_start_packet to prevent an unsigned underflow in sasl_io_read_packet
CVE-2026-76560: reject anonymous clients before evaluating the SELFDN, USERDNATTR and LDAPURL ACI bind rules
CVE-2026-18453: check the paged-results backend pointer for NULL before reusing a slot in op_shared_search

Record: CLSA-2026-1789580964
Updated: 2026-11-02

OSVCLSA-2026-1789654818 No score

389-ds-base: Fix of 5 CVEs

CVE-2026-18355: reject SASL packet lengths below the already-consumed offset in sasl_io_start_packet
CVE-2026-18453: avoid NULL pointer dereference in op_shared_search with paged results and USE_ONE_BACKEND
CVE-2026-18922: clear the stale SASL identity in the Cyrus SASL auxiliary property lookup
CVE-2026-76560: require a non-empty bind DN when evaluating SELFDN ACI bind rules
CVE-2026-78701: drain a buffered unencrypted UNBIND across recv calls instead of stalling the connection

Record: CLSA-2026-1789654818
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11739-1 No score

389-ds-3.3.1+8c2711bd6-1.1 on GA media

These are all security issues fixed in the 389-ds-3.3.1+8c2711bd6-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11739-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21950-1 No score

Security update for 389-ds

This update for 389-ds fixes the following issues:

CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133).
CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remote code execution (bsc#1279864).
CVE-2026-18453: 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (bsc#1279572).
CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication allows unauthenticated attackers to achieve privilege escalation to Directory Manager (bsc#1279865).
CVE-2026-19843: unescaped LDAP DN in Cockpit 389 Console LDAP editor allows an LDAP user with delegated privileges to execute shell commands with root privileges on the directory server host (bsc#1279866).
CVE-2026-76560: incorrect matching in the SELFDN ACI bind-rule evaluator allows an anonymous LDAP client to bypass access controls on directory entries containing empty SELFDN attributes (bsc#1279867).

Changes for 389-ds:

Update to version 3.0.7~git2.2846d5288:

Issue 7757 - stack-buffer-overflow caused by slapi_attr_init_syntax() (#7759)
Issue 7796 - A large received replicaID can overflow the storage buffer (#7797)
Issue 7041 - Add WebUI test for group member management (#7111)
Issue 7808 - CI - harden online_import_nosync_test (#7809)
Issue 7611 - PBKDF2 password verification should reject invalid iteration counts (#7632) (#7812)
[Backport 389-ds-base-3.0] Update rust-dependencies (#7799)
Issue 7595 - Remove the nightly dedup gate and fix dispatched test runs
Fix expiration time check (#7718)
Issue 7774 - Add backport action (#7775)
Issue 7770 - Testimony failure in test_cleanruv_extop_security.py (#7771)
Issue 3082 - Add test389.topologies compatibility shim for backports (#7725)
Issue 7595 - Skip redundant CI runs to relieve the Actions queue (#7749)
Issue 7760 - CI - harden dsconf_task_test.py
Issue 4701 - Fix UAF when excluding attrs from retro changelog (#7730)
Issue 7723 - Range search returns an empty result when its start key is removed (#7724)
Issue 7639 - Move log compression outside of global write lock
Issue 7631 - Don't install bpftrace by default (#7726)
Issue 7735 - Heap overflow when parsing objectclass superior (#7736)
Issue 7733 - Typo about nsuniqueid in tombstone_to_conflict (#7734)
Issue 7707 - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in join_supplier/hub/consumer (#7708)

Record: openSUSE-SU-2026:21950-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23916-1 No score

Security update for 389-ds

This update for 389-ds fixes the following issues:

CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133).
CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remote code execution (bsc#1279864).
CVE-2026-18453: 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (bsc#1279572).
CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication allows unauthenticated attackers to achieve privilege escalation to Directory Manager (bsc#1279865).
CVE-2026-19843: unescaped LDAP DN in Cockpit 389 Console LDAP editor allows an LDAP user with delegated privileges to execute shell commands with root privileges on the directory server host (bsc#1279866).
CVE-2026-76560: incorrect matching in the SELFDN ACI bind-rule evaluator allows an anonymous LDAP client to bypass access controls on directory entries containing empty SELFDN attributes (bsc#1279867).

Changes for 389-ds:

Update to version 3.0.7~git2.2846d5288:

Issue 7757 - stack-buffer-overflow caused by slapi_attr_init_syntax() (#7759)
Issue 7796 - A large received replicaID can overflow the storage buffer (#7797)
Issue 7041 - Add WebUI test for group member management (#7111)
Issue 7808 - CI - harden online_import_nosync_test (#7809)
Issue 7611 - PBKDF2 password verification should reject invalid iteration counts (#7632) (#7812)
[Backport 389-ds-base-3.0] Update rust-dependencies (#7799)
Issue 7595 - Remove the nightly dedup gate and fix dispatched test runs
Fix expiration time check (#7718)
Issue 7774 - Add backport action (#7775)
Issue 7770 - Testimony failure in test_cleanruv_extop_security.py (#7771)
Issue 3082 - Add test389.topologies compatibility shim for backports (#7725)
Issue 7595 - Skip redundant CI runs to relieve the Actions queue (#7749)
Issue 7760 - CI - harden dsconf_task_test.py
Issue 4701 - Fix UAF when excluding attrs from retro changelog (#7730)
Issue 7723 - Range search returns an empty result when its start key is removed (#7724)
Issue 7639 - Move log compression outside of global write lock
Issue 7631 - Don't install bpftrace by default (#7726)
Issue 7735 - Heap overflow when parsing objectclass superior (#7736)
Issue 7733 - Typo about nsuniqueid in tombstone_to_conflict (#7734)
Issue 7707 - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in join_supplier/hub/consumer (#7708)

Record: SUSE-SU-2026:23916-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4380-1 No score

Security update for 389-ds

This update for 389-ds fixes the following issues:

CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133).
CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remote code execution (bsc#1279864).
CVE-2026-18453: 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (bsc#1279572).
CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication allows unauthenticated attackers to achieve privilege escalation to Directory Manager (bsc#1279865).
CVE-2026-19843: unescaped LDAP DN in Cockpit 389 Console LDAP editor allows an LDAP user with delegated privileges to execute shell commands with root privileges on the directory server host (bsc#1279866).
CVE-2026-76560: incorrect matching in the SELFDN ACI bind-rule evaluator allows an anonymous LDAP client to bypass access controls on directory entries containing empty SELFDN attributes (bsc#1279867).

Changes for 389-ds:

Update to version 2.8 LTS (jsc#PED-16949).
Update to version 2.8.2~git10.030ada7a6:

Issue 6596 - BUG - Compilation Regresion (#6597) (#7866)
Issue 7627 - When it exists configured matching rule for an (#7628)
[Backport 389-ds-base-2.8] Issue 7611 - PBKDF2 password verification should reject invalid iteration counts (#7852)
iadvisories/GHSA-rgxx-hcc4-x3h4 / heap-buffer-overflow in rdn_av_swap (#7826)
Migrate pwdchan to base64 0.23 Engine API
Update rust-dependencies
Issue 7823 - CI: stabilize test_controltype_expired_grace_limit (#7824)
Issue 7815 - Support nsslapd-attribute-name-exceptions when adding entries
Issue 7757 - stack-buffer-overflow caused by slapi_attr_init_syntax() (#7759)
Issue 7796 - A large received replicaID can overflow the storage buffer (#7797)
Issue 7041 - Add WebUI test for group member management (#7111)
Issue 7808 - CI - harden online_import_nosync_test (#7809)
Issue 7595 - Remove the nightly dedup gate and fix dispatched test runs
Fix expiration time check (#7718)
Issue 7774 - Add backport action (#7775)
Issue 7770 - Testimony failure in test_cleanruv_extop_security.py (#7771)
Issue 3082 - Add test389.topologies compatibility shim for backports (#7725)
Issue 7595 - Skip redundant CI runs to relieve the Actions queue (#7751)
Issue 7760 - CI - harden dsconf_task_test.py
Issue 4701 - Fix UAF when excluding attrs from retro changelog (#7730)
Issue 7723 - Range search returns an empty result when its start key is removed (#7724)
Issue 7735 - Heap overflow when parsing objectclass superior (#7736)
Issue 7733 - Typo about nsuniqueid in tombstone_to_conflict (#7734)
Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7662)
Issue 7284 - Automated test for creating local password policy with incorrect passwordInHistory value (#7608)
Issue 7284 - CI - Fix test_grace_limit_section after pwpolicy validation fix (#7357)
Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7285)
Issue 7707 - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in join_supplier/hub/consumer (#7708)
Issue 7711 - Fix typo in accountpolicy --login-history-size help text (#7713)
Issue 7688 - BUG - partial address leak in sso token (#7689)
Issue 7705 - With memberOfEntryScope set, deferred memberOf skips MODIFY operations (#7706)
Issue 7698 - Fix silent entry loss in LMDB bulk import waiter handling (#7699)
Issue 7666 - Replication performance degradation during total init on high-latency storage (#7667)
Issue 7201 - Syscall overhead in LMDB import writer thread (#7204)
Issue 7645 - Add runtime LeakSanitizer leak check (#7646)
Issue 7714 - UI - sass import rules are deprecated
Issue 7658 - Heap…

Record: SUSE-SU-2026:4380-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4929-1 No score

Security update for 389-ds

This update for 389-ds fixes the following issues:

CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133).
CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remote code execution (bsc#1279864).
CVE-2026-18453: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (bsc#1279572).
CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication allows unauthenticated attackers to achieve privilege escalation to Directory Manager (bsc#1279865).
CVE-2026-19843: unescaped LDAP DN in Cockpit 389 Console LDAP editor allows an LDAP user with delegated privileges to execute shell commands with root privileges on the directory server host (bsc#1279866).
CVE-2026-76560: incorrect matching in the SELFDN ACI bind-rule evaluator allows an anonymous LDAP client to bypass access controls on directory entries containing empty SELFDN attributes (bsc#1279867).
CVE-2026-86344: incomplete LDAP messages sent in rapid succession can cause worker thread exhaustion (bsc#1284028).
CVE-2026-86345: smuggled plaintext commands sent alongside StartTLS requests can cause response forgery and authentication bypasses (bsc#1284034).

Update to version 2.2.11~git12.1e612cde2:

Issue 7919 - CVE-2026-86344 - Fix worker pool exhaustion via partial LDAP messages (DoS)
Issue 7921 - Fix StartTLS plaintext buffer handling (#7922) (#7947)

Update to version 2.2.11~git10.1f26fcebd:

Issue 7912 - dsidm role create-filtered ignores --nsrolefilter and forces an interactive prompt (#7913)
Issue 7908 - dsctl cockpit open-firewall --zone passes a malformed argument (#7909)
Issue 7848 - Reject incomplete MD5 and GOST-YESCRYPT hashes (#7849)
Issue 7837 - importing ldif with entry with long attribute name and subtype causes stack-buffer-overflow (#7838)
Issue 6270 - heap-use-after-free with pwp dictionary path (#7791)
Issue 7611 - PBKDF2 password verification should reject invalid iteration counts (#7632) (#7854)
iadvisories/GHSA-rgxx-hcc4-x3h4 / heap-buffer-overflow in rdn_av_swap (#7826)
Migrate pwdchan to base64 0.23 Engine API
Update rust-dependencies

Update to version 2.2.11~git1.98ee3aac7:

Issue 7757 - stack-buffer-overflow caused by slapi_attr_init_syntax() (#7759)
Bump version to 2.2.11
Security fix for CVE-2026-76560
Security fix for CVE-2026-19843
Security fix for CVE-2026-18922
Security fix for CVE-2026-18453
Security fix for CVE-2026-18355
Issue 7595 - Remove the nightly dedup gate and fix dispatched test runs
Fix expiration time check (#7718)
Issue 7774 - Add backport action (#7775)
Issue 7770 - Testimony failure in test_cleanruv_extop_security.py (#7771)
Issue 1704 - Include stdbool.h in slapi headers on 2.4 (#7768)
CVE-2026-11770 - Fix StartReplicationRequest auth gate response format
Security fix for CVE-2026-11770
Issue 3082 - Add test389.topologies compatibility shim for backports (#7725)
Issue 7595 - Skip redundant CI runs to relieve the Actions queue (#7755)
Issue 4701 - Fix UAF when excluding attrs from retro changelog (#7730)
Issue 7723 - Range search returns an empty result when its start key is removed (#7724)
Issue 7735 - Heap overflow when parsing objectclass superior (#7736)
Issue 7733 - Typo about nsuniqueid in tombstone_to_conflict (#7734)
Issue 7707 - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in join_supplier/hub/consumer (#7708)

Record: SUSE-SU-2026:4929-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4932-1 No score

Security update for 389-ds

This update for 389-ds fixes the following issues:

CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133).
CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remote code execution (bsc#1279864).
CVE-2026-18453: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (bsc#1279572).
CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication allows unauthenticated attackers to achieve privilege escalation to Directory Manager (bsc#1279865).
CVE-2026-19843: unescaped LDAP DN in Cockpit 389 Console LDAP editor allows an LDAP user with delegated privileges to execute shell commands with root privileges on the directory server host (bsc#1279866).
CVE-2026-76560: incorrect matching in the SELFDN ACI bind-rule evaluator allows an anonymous LDAP client to bypass access controls on directory entries containing empty SELFDN attributes (bsc#1279867).
CVE-2026-86344: incomplete LDAP messages sent in rapid succession can cause worker thread exhaustion (bsc#1284028).
CVE-2026-86345: smuggled plaintext commands sent alongside StartTLS requests can cause response forgery and authentication bypasses (bsc#1284034).

Update to version 2.2.11~git12.1e612cde2:

Issue 7919 - CVE-2026-86344 - Fix worker pool exhaustion via partial LDAP messages (DoS)
Issue 7921 - Fix StartTLS plaintext buffer handling (#7922) (#7947)

Update to version 2.2.11~git10.1f26fcebd:

Issue 7912 - dsidm role create-filtered ignores --nsrolefilter and forces an interactive prompt (#7913)
Issue 7908 - dsctl cockpit open-firewall --zone passes a malformed argument (#7909)
Issue 7848 - Reject incomplete MD5 and GOST-YESCRYPT hashes (#7849)
Issue 7837 - importing ldif with entry with long attribute name and subtype causes stack-buffer-overflow (#7838)
Issue 6270 - heap-use-after-free with pwp dictionary path (#7791)
Issue 7611 - PBKDF2 password verification should reject invalid iteration counts (#7632) (#7854)
iadvisories/GHSA-rgxx-hcc4-x3h4 / heap-buffer-overflow in rdn_av_swap (#7826)
Migrate pwdchan to base64 0.23 Engine API
Update rust-dependencies

Update to version 2.2.11~git1.98ee3aac7:

Issue 7757 - stack-buffer-overflow caused by slapi_attr_init_syntax() (#7759)
Bump version to 2.2.11
Security fix for CVE-2026-76560
Security fix for CVE-2026-19843
Security fix for CVE-2026-18922
Security fix for CVE-2026-18453
Security fix for CVE-2026-18355
Issue 7595 - Remove the nightly dedup gate and fix dispatched test runs
Fix expiration time check (#7718)
Issue 7774 - Add backport action (#7775)
Issue 7770 - Testimony failure in test_cleanruv_extop_security.py (#7771)
Issue 1704 - Include stdbool.h in slapi headers on 2.4 (#7768)
CVE-2026-11770 - Fix StartReplicationRequest auth gate response format
Security fix for CVE-2026-11770
Issue 3082 - Add test389.topologies compatibility shim for backports (#7725)
Issue 7595 - Skip redundant CI runs to relieve the Actions queue (#7755)
Issue 4701 - Fix UAF when excluding attrs from retro changelog (#7730)
Issue 7723 - Range search returns an empty result when its start key is removed (#7724)
Issue 7735 - Heap overflow when parsing objectclass superior (#7736)
Issue 7733 - Typo about nsuniqueid in tombstone_to_conflict (#7734)
Issue 7707 - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in join_supplier/hub/consumer (#7708)

Record: SUSE-SU-2026:4932-1
Updated: 2026-11-02

Affected products

Show 11 moreShow less

Affected packages

Affected packages
Package	Affected	Fixed
`389-ds-base` AlmaLinux:9 From an advisory covering 6 CVEs	before 2.8.0-10.el9_8	2.8.0-10.el9_8
`389-ds-base-devel` AlmaLinux:9 From an advisory covering 6 CVEs	before 2.8.0-10.el9_8	2.8.0-10.el9_8
`389-ds-base-libs` AlmaLinux:9 From an advisory covering 6 CVEs	before 2.8.0-10.el9_8	2.8.0-10.el9_8
`389-ds-base-snmp` AlmaLinux:9 From an advisory covering 6 CVEs	before 2.8.0-10.el9_8	2.8.0-10.el9_8
`python3-lib389` AlmaLinux:9 From an advisory covering 6 CVEs	before 2.8.0-10.el9_8	2.8.0-10.el9_8
`389-ds-base` AlmaLinux:10 From an advisory covering 6 CVEs	before 3.2.0-10.el10_2	3.2.0-10.el10_2
`389-ds-base-bdb` AlmaLinux:10 From an advisory covering 6 CVEs	before 3.2.0-10.el10_2	3.2.0-10.el10_2
`389-ds-base-devel` AlmaLinux:10 From an advisory covering 6 CVEs	before 3.2.0-10.el10_2	3.2.0-10.el10_2
`389-ds-base-libs` AlmaLinux:10 From an advisory covering 6 CVEs	before 3.2.0-10.el10_2	3.2.0-10.el10_2
`389-ds-base-snmp` AlmaLinux:10 From an advisory covering 6 CVEs	before 3.2.0-10.el10_2	3.2.0-10.el10_2

Show 241 moreShow less

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts	EUVD, NVD, OSV
Nov 4, 2026	facts	CVE List
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-18355 is a high vulnerability (CVSS 7.5) in Red Hat Directory Server 11.5 E4s For Rhel 8, published September 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 57th percentile. No source names a fixed version.

References

Show 104 moreShow less

This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.