Redhat 389 Directory Server vulnerabilities

• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account CVE-2026-18651 5.4 MediumAugust 3, 2026
• redhat 389 directory server, directory server, red hat directory server 11.5 e4s for rhel 8 +22 more +24 more 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check CVE-2026-11770 7.5 HighJuly 31, 2026
• redhat 389 directory server, directory server, red hat directory server 11.5 e4s for rhel 8 +22 more +24 more 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing CVE-2026-15722 Fix available 7.5 HighJuly 31, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification CVE-2026-15041 3.7 LowJuly 8, 2026
• red hat directory server 11, directory server 12, directory server 13 +8 more +10 more 389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption CVE-2026-14969 4.4 MediumJuly 7, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn CVE-2026-14940 5.3 MediumJuly 7, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht() CVE-2026-11791 5.0 MediumJune 18, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt() CVE-2026-12528 5.4 MediumJune 17, 2026
• redhat 389 directory server, red hat directory server 11, directory server 12 +6 more +8 more 389-ds-base: 389-ds-base: stack buffer overflow in checkprefix() algorithm id parsing CVE-2026-11793 4.9 MediumJune 9, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service CVE-2026-11790 4.9 MediumJune 9, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash CVE-2026-11789 4.9 MediumJune 9, 2026
• redhat 389 directory server, directory server, red hat directory server 11.5 e4s for rhel 8 +22 more +24 more 389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser CVE-2026-11788 5.9 MediumJune 9, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing CVE-2026-11787 5.0 MediumJune 9, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type() CVE-2026-11786 1.9 LowJune 9, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handler CVE-2026-11785 4.3 MediumJune 9, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions CVE-2026-11611 6.5 MediumJune 8, 2026
• red hat directory server 11.5 e4s for rhel 8, directory server 11.7 e4s for rhel 8, directory server 11.9 for rhel 8 +23 more +25 more 389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos) CVE-2026-9064 Fix available 7.5 HighMay 20, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +7 more +9 more 389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request CVE-2024-6237 Fix available 6.5 MediumJuly 9, 2024
• fedoraproject fedora, red hat directory server 11.5 e4s for rhel 8, directory server 11.7 for rhel 8 +22 more +24 more 389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr) CVE-2024-1062 Fix available 5.5 MediumFebruary 8, 2024
• fedoraproject fedora, redhat 389 directory server, directory server +1 more +3 more An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that... CVE-2022-1949 Fix available 7.5 HighJune 1, 2022
• redhat 389 directory server, fedoraproject fedora, redhat enterprise linux +2 more A vulnerability was found in the 389 Directory Server that allows expired passwords to access the... CVE-2022-0996 Fix available 6.5 MediumMarch 23, 2022
• redhat 389 directory server When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer... CVE-2021-3514 Fix available 6.5 MediumMay 28, 2021
• redhat 389 directory server, directory server, enterprise linux +2 more When binding against a DN during authentication, the reply from 389-ds-base will be different... CVE-2020-35518 Fix available 5.3 MediumMarch 8, 2021
• red hat directory server, redhat 389 directory server +1 more The _ger_parse_control function in Red Hat Directory Server 8 and the 389 Directory Server allows... CVE-2010-2222 7.5 HighNovember 5, 2019
• redhat 389 directory server, red hat 389-ds-base +1 more A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP... CVE-2018-10935 Fix available 6.5 MediumAugust 30, 2018