{"id":"CVE-2026-86344","aliases":["AZL-107951","CLSA-2026-1792597970","DEBIAN-CVE-2026-86344","EUVD-2026-91076","GHSA-62jf-8m49-534w","SUSE-SU-2026:4929-1","SUSE-SU-2026:4932-1","UBUNTU-CVE-2026-86344","openSUSE-SU-2026:12312-1"],"status":"published","title":"389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue","description":"A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00347,"percentile":0.28691,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-400"],"published":"2026-10-01T21:29:55Z","modified":"2026-11-05T09:47:37Z","affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.1-12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-5.el9_2.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"389-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-5.el9_2.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"389-ds-base-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-5.el9_2.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"389-ds-base-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-5.el9_2.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-lib389","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-5.el9_2.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.1+dfsg1-1","2.3.1+dfsg1-1+deb12u1","2.3.4+dfsg1-1","2.3.4+dfsg1-1.1","2.4.4+dfsg1-1","2.4.4+dfsg1-3","2.4.5+dfsg1-1","3.0.2+dfsg1-1","3.1.1+dfsg1-1","3.1.1+dfsg1-2","3.1.1+dfsg1-3","3.1.2+dfsg1-1","3.1.2+vendor1-1","3.1.2+vendor1-2","3.3.0-1","3.3.0-2","3.3.1-1","3.3.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2+dfsg1-1","3.1.2+dfsg1-1+deb13u1","3.1.2+vendor1-1","3.1.2+vendor1-2","3.3.0-1","3.3.0-2","3.3.1-1","3.3.1-3"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11~git12.1e612cde2-150600.8.38.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11~git12.1e612cde2-150600.8.38.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11~git12.1e612cde2-150500.3.54.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11~git12.1e612cde2-150500.3.54.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11~git12.1e612cde2-150500.3.54.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11~git12.1e612cde2-150500.3.54.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.3.12-1build1","1.3.3.13-1","1.3.4.5-2","1.3.4.8-1","1.3.4.8-3","1.3.4.8-3ubuntu1","1.3.4.8-4","1.3.4.9-1","1.3.4.9-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.7.5-1","1.3.7.5-1build1","1.3.7.5-1build2","1.3.7.9-1","1.3.7.10-1","1.3.7.10-1ubuntu1","1.3.7.10-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.1.6-4","1.4.1.6-4build1","1.4.2.4-1","1.4.2.4-1build1","1.4.3.2-1","1.4.3.2-1build1","1.4.3.6-2","1.4.3.6-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.4.11-2build1","1.4.4.11-2build2","1.4.4.17-1","2.0.11-2","2.0.14-1","2.0.15-1","2.0.15-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.4+dfsg1-1","2.4.4+dfsg1-1ubuntu1","2.4.4+dfsg1-1ubuntu4","2.4.4+dfsg1-3","2.4.5+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2+vendor1-2","3.1.2+vendor1-2build1","3.3.1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2+dfsg1-1","3.1.2+vendor1-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1+28b6d8afc-1.1"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"red hat directory server 11"},{"vendor":"red hat","product":"red hat directory server 12"},{"vendor":"red hat","product":"red hat directory server 13"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-86344","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529329","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86344","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-62jf-8m49-534w"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792597970.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86345","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-86344","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264929-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273133","tags":["report"]},{"url":"https://bugzilla.suse.com/1279572","tags":["report"]},{"url":"https://bugzilla.suse.com/1279864","tags":["report"]},{"url":"https://bugzilla.suse.com/1279865","tags":["report"]},{"url":"https://bugzilla.suse.com/1279866","tags":["report"]},{"url":"https://bugzilla.suse.com/1279867","tags":["report"]},{"url":"https://bugzilla.suse.com/1284028","tags":["report"]},{"url":"https://bugzilla.suse.com/1284034","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86345","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264932-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-86344","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86344","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-86344","title":"389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue","description":"A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.","status":"published","published":"2026-10-01T21:29:55.877Z","modified":"2026-10-02T18:22:47.877Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T13:49:31.546614Z"}],"euvd":[{"id":"EUVD-2026-91076","description":"A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.","status":"published","published":"2026-10-01T21:29:55Z","modified":"2026-10-02T18:22:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:42.349288Z"}],"ghsa":[{"id":"GHSA-62jf-8m49-534w","title":"A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP...","description":"A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.","status":"published","published":"2026-10-02T00:31:31Z","modified":"2026-10-02T00:31:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:12:41.838372Z"}],"nvd":[{"id":"CVE-2026-86344","description":"A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.","status":"published","published":"2026-10-01T22:17:05.59Z","modified":"2026-11-05T00:17:33.963Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-05T01:45:11.587441Z"}],"osv":[{"id":"DEBIAN-CVE-2026-86344","description":"A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.","status":"published","published":"2026-10-01T22:17:05.59Z","modified":"2026-11-05T09:47:37.999811389Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"UBUNTU-CVE-2026-86344","description":"A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.","status":"published","published":"2026-10-01T22:17:00Z","modified":"2026-10-17T13:01:13.698121928Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"AZL-107951","title":"CVE-2026-86344 affecting package 389-ds-base 3.1.1-12","description":"A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.","status":"published","published":"2026-10-01T22:17:05Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.199293Z"},{"id":"CLSA-2026-1792597970","title":"389-ds-base: Fix of 2 CVEs","description":"- CVE-2026-86345: reject StartTLS when plaintext data is buffered after the request\n- CVE-2026-86344: fix worker pool exhaustion via partial LDAP messages","status":"published","published":"2026-10-21T15:53:02Z","modified":"2026-10-26T09:43:26.352702378Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"openSUSE-SU-2026:12312-1","title":"389-ds-3.3.1+28b6d8afc-1.1 on GA media","description":"These are all security issues fixed in the 389-ds-3.3.1+28b6d8afc-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-28T00:00:00Z","modified":"2026-10-29T12:15:05.333587494Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:4929-1","title":"Security update for 389-ds","description":"This update for 389-ds fixes the following issues:\n\n- CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133).\n- CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of\n  service or potentially achieve remote code execution (bsc#1279864).\n- CVE-2026-18453: pre-authentication NULL pointer dereference via paged results and\n  USE_ONE_BACKEND control in op_shared_search (bsc#1279572).\n- CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication allows\n  unauthenticated attackers to achieve privilege escalation to Directory Manager (bsc#1279865).\n- CVE-2026-19843: unescaped LDAP DN in Cockpit 389 Console LDAP editor allows an LDAP user with delegated privileges to\n  execute shell commands with root privileges on the directory server host (bsc#1279866).\n- CVE-2026-76560: incorrect matching in the SELFDN ACI bind-rule evaluator allows an anonymous LDAP client to bypass\n  access controls on directory entries containing empty SELFDN attributes (bsc#1279867).\n- CVE-2026-86344: incomplete LDAP messages sent in rapid succession can cause worker thread exhaustion (bsc#1284028).\n- CVE-2026-86345: smuggled plaintext commands sent alongside StartTLS requests can cause response forgery and\n  authentication bypasses (bsc#1284034).\n  \nUpdate to version 2.2.11~git12.1e612cde2:\n \n * Issue 7919 - CVE-2026-86344 - Fix worker pool exhaustion via partial LDAP messages (DoS)\n * Issue 7921 - Fix StartTLS plaintext buffer handling (#7922) (#7947)\n  \nUpdate to version 2.2.11~git10.1f26fcebd:\n \n * Issue 7912 - dsidm role create-filtered ignores --nsrolefilter and forces an interactive prompt (#7913)\n * Issue 7908 - dsctl cockpit open-firewall --zone passes a malformed argument (#7909)\n * Issue 7848 - Reject incomplete MD5 and GOST-YESCRYPT hashes (#7849)\n * Issue 7837 - importing ldif with entry with long attribute name and subtype causes stack-buffer-overflow (#7838)\n * Issue 6270 - heap-use-after-free with pwp dictionary path (#7791)\n * Issue 7611 - PBKDF2 password verification should reject invalid iteration counts (#7632) (#7854)\n * iadvisories/GHSA-rgxx-hcc4-x3h4 / heap-buffer-overflow in rdn_av_swap (#7826)\n * Migrate pwdchan to base64 0.23 Engine API\n * Update rust-dependencies\n\nUpdate to version 2.2.11~git1.98ee3aac7:\n \n * Issue 7757 - stack-buffer-overflow caused by slapi_attr_init_syntax() (#7759)\n * Bump version to 2.2.11\n * Security fix for CVE-2026-76560\n * Security fix for CVE-2026-19843\n * Security fix for CVE-2026-18922\n * Security fix for CVE-2026-18453\n * Security fix for CVE-2026-18355\n * Issue 7595 - Remove the nightly dedup gate and fix dispatched test runs\n * Fix expiration time check (#7718)\n * Issue 7774 - Add backport action (#7775)\n * Issue 7770 - Testimony failure in test_cleanruv_extop_security.py (#7771)\n * Issue 1704 - Include stdbool.h in slapi headers on 2.4 (#7768)\n * CVE-2026-11770 - Fix StartReplicationRequest auth gate response format\n * Security fix for CVE-2026-11770\n * Issue 3082 - Add test389.topologies compatibility shim for backports (#7725)\n * Issue 7595 - Skip redundant CI runs to relieve the Actions queue (#7755)\n * Issue 4701 - Fix UAF when excluding attrs from retro changelog (#7730)\n * Issue 7723 - Range search returns an empty result when its start key is removed (#7724)\n * Issue 7735 - Heap overflow when parsing objectclass superior (#7736)\n * Issue 7733 - Typo about nsuniqueid in tombstone_to_conflict (#7734)\n * Issue 7707 - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in join_supplier/hub/consumer (#7708)\n","status":"published","published":"2026-10-29T08:52:52Z","modified":"2026-10-31T18:00:05.032423614Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4932-1","title":"Security update for 389-ds","description":"This update for 389-ds fixes the following issues:\n\n- CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133).\n- CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of\n  service or potentially achieve remote code execution (bsc#1279864).\n- CVE-2026-18453: pre-authentication NULL pointer dereference via paged results and\n  USE_ONE_BACKEND control in op_shared_search (bsc#1279572).\n- CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication allows\n  unauthenticated attackers to achieve privilege escalation to Directory Manager (bsc#1279865).\n- CVE-2026-19843: unescaped LDAP DN in Cockpit 389 Console LDAP editor allows an LDAP user with delegated privileges to\n  execute shell commands with root privileges on the directory server host (bsc#1279866).\n- CVE-2026-76560: incorrect matching in the SELFDN ACI bind-rule evaluator allows an anonymous LDAP client to bypass\n  access controls on directory entries containing empty SELFDN attributes (bsc#1279867).\n- CVE-2026-86344: incomplete LDAP messages sent in rapid succession can cause worker thread exhaustion (bsc#1284028).\n- CVE-2026-86345: smuggled plaintext commands sent alongside StartTLS requests can cause response forgery and\n  authentication bypasses (bsc#1284034).\n  \nUpdate to version 2.2.11~git12.1e612cde2:\n \n * Issue 7919 - CVE-2026-86344 - Fix worker pool exhaustion via partial LDAP messages (DoS)\n * Issue 7921 - Fix StartTLS plaintext buffer handling (#7922) (#7947)\n  \nUpdate to version 2.2.11~git10.1f26fcebd:\n \n * Issue 7912 - dsidm role create-filtered ignores --nsrolefilter and forces an interactive prompt (#7913)\n * Issue 7908 - dsctl cockpit open-firewall --zone passes a malformed argument (#7909)\n * Issue 7848 - Reject incomplete MD5 and GOST-YESCRYPT hashes (#7849)\n * Issue 7837 - importing ldif with entry with long attribute name and subtype causes stack-buffer-overflow (#7838)\n * Issue 6270 - heap-use-after-free with pwp dictionary path (#7791)\n * Issue 7611 - PBKDF2 password verification should reject invalid iteration counts (#7632) (#7854)\n * iadvisories/GHSA-rgxx-hcc4-x3h4 / heap-buffer-overflow in rdn_av_swap (#7826)\n * Migrate pwdchan to base64 0.23 Engine API\n * Update rust-dependencies\n\nUpdate to version 2.2.11~git1.98ee3aac7:\n \n * Issue 7757 - stack-buffer-overflow caused by slapi_attr_init_syntax() (#7759)\n * Bump version to 2.2.11\n * Security fix for CVE-2026-76560\n * Security fix for CVE-2026-19843\n * Security fix for CVE-2026-18922\n * Security fix for CVE-2026-18453\n * Security fix for CVE-2026-18355\n * Issue 7595 - Remove the nightly dedup gate and fix dispatched test runs\n * Fix expiration time check (#7718)\n * Issue 7774 - Add backport action (#7775)\n * Issue 7770 - Testimony failure in test_cleanruv_extop_security.py (#7771)\n * Issue 1704 - Include stdbool.h in slapi headers on 2.4 (#7768)\n * CVE-2026-11770 - Fix StartReplicationRequest auth gate response format\n * Security fix for CVE-2026-11770\n * Issue 3082 - Add test389.topologies compatibility shim for backports (#7725)\n * Issue 7595 - Skip redundant CI runs to relieve the Actions queue (#7755)\n * Issue 4701 - Fix UAF when excluding attrs from retro changelog (#7730)\n * Issue 7723 - Range search returns an empty result when its start key is removed (#7724)\n * Issue 7735 - Heap overflow when parsing objectclass superior (#7736)\n * Issue 7733 - Typo about nsuniqueid in tombstone_to_conflict (#7734)\n * Issue 7707 - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in join_supplier/hub/consumer (#7708)\n","status":"published","published":"2026-10-29T08:54:25Z","modified":"2026-10-31T18:00:03.94608977Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}