{"id":"CVE-2026-22185","aliases":["BELL-CVE-2026-22185","DEBIAN-CVE-2026-22185","EUVD-2026-1169","GHSA-gcc9-wqf3-69qj","OESA-2026-1334","OESA-2026-1335","OESA-2026-1425","OESA-2026-1426","OESA-2026-1427","OESA-2026-1428","OESA-2026-3283","ROOT-OS-DEBIAN-12-CVE-2026-22185","SUSE-SU-2026:0256-1","UBUNTU-CVE-2026-22185"],"status":"published","title":"OpenLDAP LMDB mdb_load Heap Buffer Underflow in readline()","description":"OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.","severity":{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00152,"percentile":0.04373,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-191"],"published":"2026-01-07T20:26:30Z","modified":"2026-11-09T02:00:06Z","fixes":[{"ecosystem":"Alpaquita:23","package":"lmdb","fixed_in":["0.9.29-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openldap","fixed_in":["2.6.3-r8"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"lmdb","fixed_in":["0.9.33-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openldap","fixed_in":["2.6.8-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"lmdb","fixed_in":["0.9.33-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openldap","fixed_in":["2.6.10-r1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lmdb","fixed_in":["0.9.35-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"openldap","fixed_in":["2.6.5-7.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"openldap","fixed_in":["2.4.50-10.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"openldap","fixed_in":["2.6.0-11.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"openldap","fixed_in":["2.6.5-7.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"openldap","fixed_in":["2.6.5-7.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"openldap","fixed_in":["2.6.5-7.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"lmdb","fixed_in":["0.9.31-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"lmdb","fixed_in":["0.9.31-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"lmdb","fixed_in":["0.9.31-3.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"lmdb","fixed_in":["0.9.24-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"lmdb","fixed_in":["0.9.30-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"lmdb","fixed_in":["0.9.24-1.root.io.2","0.9.24-1.root.io.1","0.9.24-1.aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"openldap","fixed_in":["2.5.13+dfsg-5.root.io.6","2.5.13+dfsg-5.aikido.7"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-lmdb","fixed_in":["0.9.24-1.root.io.2","0.9.24-1.root.io.1","0.9.24-1.aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-openldap","fixed_in":["2.5.13+dfsg-5.root.io.6","2.5.13+dfsg-5.aikido.7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"openldap2_5","fixed_in":["2.5.20+11-150500.11.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"openldap2_5","fixed_in":["2.5.20+11-150500.11.38.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"openldap2_5","fixed_in":["2.5.20+11-150500.11.38.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.29-r2"},{"fixed":"0.9.29-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.3-r6"},{"fixed":"2.6.3-r8"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.33-r0"},{"fixed":"0.9.33-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.8-r1"},{"fixed":"2.6.8-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.29-r2"},{"fixed":"0.9.33-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.4-r3"},{"fixed":"2.6.10-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.24-1","0.9.31-1","0.9.35-1"]},{"source":"osv","ecosystem":"Debian:13","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.31-1","0.9.35-1"]},{"source":"osv","ecosystem":"Debian:14","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.35-1"}]}],"versions":["0.9.31-1"]},{"source":"osv","ecosystem":"Debian:12","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.2.12-1","2.5.13+dfsg-5","2.5.13+dfsg-5+loong64","2.5.16+dfsg-1","2.5.16+dfsg-2","2.5.17+dfsg-1","2.5.18+dfsg-1","2.5.18+dfsg-2","2.5.18+dfsg-3","2.5.19+dfsg-1","2.6.10+dfsg-1","2.6.13+dfsg-1","2.6.14+dfsg-1","2.6.14+dfsg-2","2.6.2+dfsg-1~exp1","2.6.2+dfsg-1~exp2","2.6.3+dfsg-1~exp1","2.6.4+dfsg-1~exp1","2.6.5+dfsg-1~exp1","2.6.6+dfsg-1~exp1","2.6.6+dfsg-1~exp2","2.6.7+dfsg-1~exp1","2.6.8+dfsg-1~exp1","2.6.8+dfsg-1~exp2","2.6.8+dfsg-1~exp3","2.6.8+dfsg-1~exp4","2.6.9+dfsg-1","2.6.9+dfsg-1~exp1","2.6.9+dfsg-1~exp2","2.6.9+dfsg-2","2:1.2.12.1-1","2:1.2.12.1-1.0.1"]},{"source":"osv","ecosystem":"Debian:13","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.2.12-1","2.6.10+dfsg-1","2.6.13+dfsg-1","2.6.14+dfsg-1","2.6.14+dfsg-2","2:1.2.12.1-1","2:1.2.12.1-1.0.1"]},{"source":"osv","ecosystem":"Debian:14","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.2.12-1","2.6.10+dfsg-1","2.6.13+dfsg-1","2.6.14+dfsg-1","2.6.14+dfsg-2","2:1.2.12.1-1","2:1.2.12.1-1.0.1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.5-7.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-10.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-11.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.5-7.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.5-7.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.5-7.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.31-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.31-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.31-3.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.24-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.30-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.24-1.root.io.2"},{"fixed":"0.9.24-1.root.io.1"},{"fixed":"0.9.24-1.aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.13+dfsg-5.root.io.6"},{"fixed":"2.5.13+dfsg-5.aikido.7"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.24-1.root.io.2"},{"fixed":"0.9.24-1.root.io.1"},{"fixed":"0.9.24-1.aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.13+dfsg-5.root.io.6"},{"fixed":"2.5.13+dfsg-5.aikido.7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"openldap2_5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.20+11-150500.11.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"openldap2_5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.20+11-150500.11.38.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openldap2_5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.20+11-150500.11.38.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.15-1","0.9.16-1","0.9.17-1","0.9.17-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.21-1","0.9.21-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.23-0ubuntu1","0.9.24-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.24-1","0.9.24-1build1","0.9.24-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.31-1","0.9.31-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.31-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.31-1build2","0.9.35-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.31-1build1","0.9.31-1build2"]}],"products":[{"vendor":"openldap foundation","product":"openldap"}],"references":[{"url":"https://seclists.org/fulldisclosure/2026/Jan/5","tags":["technical-description","exploit","report"]},{"url":"https://seclists.org/fulldisclosure/2026/Jan/8","tags":["technical-description","exploit","report"]},{"url":"https://www.openldap.org/","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/openldap-lmdb-mdb-load-heap-buffer-underflow-in-readline","tags":["third-party-advisory","report"]},{"url":"https://bugs.openldap.org/show_bug.cgi?id=10421","tags":["issue-tracking","patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22185","tags":["advisory"]},{"url":"https://www.openldap.org"},{"url":"https://github.com/advisories/GHSA-gcc9-wqf3-69qj"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-22185","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-22185","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1334","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1335","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1425","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1426","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1427","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1428","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3283","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260256-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256297","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22185","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-22185","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22185","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-22185","title":"OpenLDAP LMDB mdb_load Heap Buffer Underflow in readline()","description":"OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.","status":"published","published":"2026-01-07T20:26:30.054Z","modified":"2026-10-29T21:15:35.807Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-125","CWE-191"],"updated_at":"2026-11-02T13:39:16.730222Z"}],"euvd":[{"id":"EUVD-2026-1169","description":"OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.","status":"published","published":"2026-01-07T20:26:30Z","modified":"2026-10-29T21:15:35Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:14.250155Z"}],"ghsa":[{"id":"GHSA-gcc9-wqf3-69qj","title":"OpenLDAP Lightning Memory-Mapped Database (LMDB) mdb_load contains a heap buffer underflow...","description":"OpenLDAP Lightning Memory-Mapped Database (LMDB) mdb_load contains a heap buffer underflow vulnerability in the readline() function. When processing malformed input, an unsigned offset calculation can underflow a heap pointer, resulting in an out-of-bounds read of one byte before the allocated heap buffer. This may allow a local attacker to cause a denial of service and potentially disclose limited heap memory contents.","status":"published","published":"2026-01-07T21:31:56Z","modified":"2026-01-08T18:31:46Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:05:32.969485Z"}],"nvd":[{"id":"CVE-2026-22185","description":"OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.","status":"published","published":"2026-01-07T21:16:01.733Z","modified":"2026-10-29T21:17:22.293Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-125","CWE-191"],"updated_at":"2026-11-02T14:12:03.683495Z"}],"osv":[{"id":"DEBIAN-CVE-2026-22185","description":"OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.","status":"published","published":"2026-01-07T21:16:01.733Z","modified":"2026-11-09T02:00:06.841838099Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-09T02:13:49.854871Z"},{"id":"OESA-2026-1334","title":"openldap security update","description":"OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools. LDAP is a set of protocols for accessing directory services (usually phone book style information, but other information is possible) over the Internet, similar to the way DNS (Domain Name System) information is propagated over the Internet. The openldap package contains configuration files, libraries, and documentation for OpenLDAP.\r\n\r\nSecurity Fix(es):\n\nOpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.(CVE-2026-22185)","status":"published","published":"2026-02-13T11:10:21Z","modified":"2026-08-18T01:19:32.691123919Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1335","title":"openldap security update","description":"OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools. LDAP is a set of protocols for accessing directory services (usually phone book style information, but other information is possible) over the Internet, similar to the way DNS (Domain Name System) information is propagated over the Internet. The openldap package contains configuration files, libraries, and documentation for OpenLDAP.\r\n\r\nSecurity Fix(es):\n\nOpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.(CVE-2026-22185)","status":"published","published":"2026-02-13T11:10:21Z","modified":"2026-08-18T01:19:32.719766468Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1425","title":"openldap security update","description":"OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools. LDAP is a set of protocols for accessing directory services (usually phone book style information, but other information is possible) over the Internet, similar to the way DNS (Domain Name System) information is propagated over the Internet. The openldap package contains configuration files, libraries, and documentation for OpenLDAP.\r\n\r\nSecurity Fix(es):\n\nOpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.(CVE-2026-22185)","status":"published","published":"2026-02-28T11:10:26Z","modified":"2026-08-18T01:19:34.46851282Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1426","title":"openldap security update","description":"OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools. LDAP is a set of protocols for accessing directory services (usually phone book style information, but other information is possible) over the Internet, similar to the way DNS (Domain Name System) information is propagated over the Internet. The openldap package contains configuration files, libraries, and documentation for OpenLDAP.\r\n\r\nSecurity Fix(es):\n\nOpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.(CVE-2026-22185)","status":"published","published":"2026-02-28T11:10:26Z","modified":"2026-08-18T01:19:34.518896319Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1427","title":"openldap security update","description":"OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools. LDAP is a set of protocols for accessing directory services (usually phone book style information, but other information is possible) over the Internet, similar to the way DNS (Domain Name System) information is propagated over the Internet. The openldap package contains configuration files, libraries, and documentation for OpenLDAP.\r\n\r\nSecurity Fix(es):\n\nOpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.(CVE-2026-22185)","status":"published","published":"2026-02-28T11:10:26Z","modified":"2026-08-18T01:19:34.374596919Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1428","title":"openldap security update","description":"OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools. LDAP is a set of protocols for accessing directory services (usually phone book style information, but other information is possible) over the Internet, similar to the way DNS (Domain Name System) information is propagated over the Internet. The openldap package contains configuration files, libraries, and documentation for OpenLDAP.\r\n\r\nSecurity Fix(es):\n\nOpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.(CVE-2026-22185)","status":"published","published":"2026-02-28T11:10:26Z","modified":"2026-08-18T01:19:34.34497639Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-3283","title":"lmdb security update","description":"Symas LMDB is an extraordinarily fast, memory-efficient database we developed for the OpenLDAP Project. With memory-mapped files, it has the read performance of a pure in-memory database while retaining the persistence of standard disk-based databases.\r\n\r\nSecurity Fix(es):\n\nOpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.(CVE-2026-22185)","status":"published","published":"2026-08-07T02:43:33Z","modified":"2026-08-07T03:00:57.032765217Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-22185","title":"CVE-2026-22185 in lmdb - Patched by Root","description":"Root has patched CVE-2026-22185 in the lmdb package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T12:17:55Z","modified":"2026-08-26T01:10:36.775399501Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:31.773105Z"},{"id":"UBUNTU-CVE-2026-22185","description":"OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.","status":"published","published":"2026-01-07T21:16:00Z","modified":"2026-11-05T11:46:32.886240141Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-05T13:30:15.321876Z"},{"id":"BELL-CVE-2026-22185","status":"published","published":"2026-01-09T06:07:44.455895Z","modified":"2026-03-04T13:49:19.31305Z","updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"SUSE-SU-2026:0256-1","title":"Security update for openldap2_5","description":"This update for openldap2_5 fixes the following issues:\n\nSecurity fixes:\n  \n- CVE-2026-22185: Fixed possible crash in malicious DB (bsc#1256297)\n  \nOther fixes:\n\n- Update to version 2.5.20+11:\n    \n    * ITS#10421 mdb_load: check for malicious input\n","status":"published","published":"2026-01-22T16:08:55Z","modified":"2026-03-23T04:50:24.264848Z","updated_at":"2026-11-02T15:54:00.846737Z"}]}}