Redhat Directory Server vulnerabilities

• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account CVE-2026-18651 5.4 MediumAugust 3, 2026
• redhat 389 directory server, directory server, red hat directory server 11.5 e4s for rhel 8 +22 more +24 more 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check CVE-2026-11770 7.5 HighJuly 31, 2026
• redhat 389 directory server, directory server, red hat directory server 11.5 e4s for rhel 8 +22 more +24 more 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing CVE-2026-15722 Fix available 7.5 HighJuly 31, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification CVE-2026-15041 3.7 LowJuly 8, 2026
• red hat directory server 11, directory server 12, directory server 13 +8 more +10 more 389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption CVE-2026-14969 4.4 MediumJuly 7, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn CVE-2026-14940 5.3 MediumJuly 7, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht() CVE-2026-11791 5.0 MediumJune 18, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt() CVE-2026-12528 5.4 MediumJune 17, 2026
• redhat 389 directory server, red hat directory server 11, directory server 12 +6 more +8 more 389-ds-base: 389-ds-base: stack buffer overflow in checkprefix() algorithm id parsing CVE-2026-11793 4.9 MediumJune 9, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service CVE-2026-11790 4.9 MediumJune 9, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash CVE-2026-11789 4.9 MediumJune 9, 2026
• redhat 389 directory server, directory server, red hat directory server 11.5 e4s for rhel 8 +22 more +24 more 389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser CVE-2026-11788 5.9 MediumJune 9, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing CVE-2026-11787 5.0 MediumJune 9, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type() CVE-2026-11786 1.9 LowJune 9, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handler CVE-2026-11785 4.3 MediumJune 9, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more 389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions CVE-2026-11611 6.5 MediumJune 8, 2026
• red hat directory server 11.5 e4s for rhel 8, directory server 11.7 e4s for rhel 8, directory server 11.9 for rhel 8 +23 more +25 more 389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos) CVE-2026-9064 Fix available 7.5 HighMay 20, 2026
• redhat 389 directory server, directory server, red hat directory server 11 +7 more +9 more 389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request CVE-2024-6237 Fix available 6.5 MediumJuly 9, 2024
• fedoraproject fedora, red hat directory server 11.5 e4s for rhel 8, directory server 11.7 for rhel 8 +22 more +24 more 389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr) CVE-2024-1062 Fix available 5.5 MediumFebruary 8, 2024
• fedoraproject fedora, red hat directory server +1 more A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the... CVE-2023-1055 Fix available 5.5 MediumFebruary 27, 2023
• port389 389-ds-base, debian linux, fedoraproject fedora +2 more +4 more A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an... CVE-2022-2850 Fix available 6.5 MediumSeptember 5, 2022
• fedoraproject fedora, redhat 389 directory server, directory server +1 more +3 more An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that... CVE-2022-1949 Fix available 7.5 HighJune 1, 2022
• redhat 389 directory server, fedoraproject fedora, redhat enterprise linux +2 more A vulnerability was found in the 389 Directory Server that allows expired passwords to access the... CVE-2022-0996 Fix available 6.5 MediumMarch 23, 2022
• redhat 389 directory server When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer... CVE-2021-3514 Fix available 6.5 MediumMay 28, 2021
• redhat 389 directory server, directory server, enterprise linux +2 more When binding against a DN during authentication, the reply from 389-ds-base will be different... CVE-2020-35518 Fix available 5.3 MediumMarch 8, 2021
• fedoraproject 389 directory server, hp hp-ux directory server, redhat directory server +2 more 389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server... CVE-2010-3282 3.3 LowJanuary 9, 2020
• red hat directory server, redhat 389 directory server +1 more The _ger_parse_control function in Red Hat Directory Server 8 and the 389 Directory Server allows... CVE-2010-2222 7.5 HighNovember 5, 2019
• redhat 389 directory server, red hat 389-ds-base +1 more A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP... CVE-2018-10935 Fix available 6.5 MediumAugust 30, 2018
• fedoraproject 389 directory server, redhat directory server, enterprise linux +2 more Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote... CVE-2014-3562 Fix available 5.0 MediumAugust 18, 2014
• fedoraproject 389 directory server, redhat directory server, enterprise linux +2 more 389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote... CVE-2013-4485 Fix available 4.0 MediumNovember 23, 2013
• fedoraproject 389 directory server, redhat directory server +1 more The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict... CVE-2013-2219 Fix available 4.0 MediumJuly 31, 2013
• fedoraproject 389 directory server, redhat directory server +1 more 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the... CVE-2012-2746 2.1 LowJuly 3, 2012
• fedoraproject 389 directory server, redhat directory server +1 more 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the... CVE-2012-2678 1.2 LowJuly 3, 2012
• fedoraproject 389 directory server, redhat directory server +1 more The (1) backup and restore scripts, (2) main initialization script, and (3) ldap-agent script in... CVE-2011-0532 6.2 MediumFebruary 23, 2011
• fedoraproject 389 directory server, redhat directory server +1 more The setup scripts in 389 Directory Server 1.2.x (aka Red Hat Directory Server 8.2.x), when... CVE-2011-0022 4.7 MediumFebruary 23, 2011
• fedoraproject 389 directory server, redhat directory server +1 more slapd (aka ns-slapd) in 389 Directory Server 1.2.7.5 (aka Red Hat Directory Server 8.2.x or... CVE-2011-0019 7.5 HighFebruary 23, 2011
• redhat directory server The (1) setup-ds.pl and (2) setup-ds-admin.pl setup scripts for Red Hat Directory Server 8 before... CVE-2010-2241 Fix available 2.1 LowAugust 17, 2010
• fedora directory server Multiple memory leaks in Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and... CVE-2008-3283 7.8 HighAugust 29, 2008
• fedora directory server Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server... CVE-2008-2930 Public exploit 7.1 HighAugust 29, 2008
• fedora directory server Multiple cross-site scripting (XSS) vulnerabilities in the adminutil library in the Directory... CVE-2008-2929 Fix available 4.3 MediumAugust 29, 2008
• redhat directory server Multiple buffer overflows in the adminutil library in CGI applications in Red Hat Directory... CVE-2008-2928 10.0 HighAugust 29, 2008
• redhat directory server, fedora directory server +1 more Buffer overflow in the regular expression handler in Red Hat Directory Server 8.0 and 7.1 before... CVE-2008-1677 Fix available 7.5 HighMay 12, 2008
• redhat directory server Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and EL5, does not... CVE-2008-0893 7.5 HighApril 16, 2008
• redhat directory server, fedora directory server +1 more The replication monitor CGI script (repl-monitor-cgi.pl) in Red Hat Administration Server, as... CVE-2008-0892 Fix available EPSS 14.0% 9.0 HighApril 16, 2008
• redhat directory server Red Hat Directory Server 8.0, when running on Red Hat Enterprise Linux, uses insecure permissions... CVE-2008-0889 Fix available 2.1 LowMarch 20, 2008
• redhat directory server Red Hat Directory Server 7.1 before SP4 uses insecure permissions for certain directories, which... CVE-2008-0890 Fix available 4.6 MediumMarch 12, 2008