389 Directory Server SASL integer overflow bypasses size limit and triggers heap buffer overflow
Last refreshed2026-11-05
Status: UPDATED
| Advisory ID: CVE-2026-11774
Key Details
CVE
CVE-2026-11774
CVSS Score / Version
7.6 (High) / CVSS v3.1
Updated
2026-11-04
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CVSS Prose
attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is low; integrity impact is low; availability impact is high.
Affected products
see table below
Classified as
CWE-190 (Integer Overflow or Wraparound)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Red Hat
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Red Hat
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Red Hat
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
Red Hat
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Red Hat
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Red Hat
Red Hat Enterprise Linux 9
Red Hat
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Red Hat
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Red Hat
Red Hat Enterprise Linux 9.6 Extended Update Support
Red Hat
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Red Hat
Red Hat Directory Server 12
Red Hat
Red Hat Directory Server 11.5 E4S for RHEL 8
Red Hat
Red Hat Directory Server 11.7 E4S for RHEL 8
Red Hat
Red Hat Directory Server 11.9 for RHEL 8
Red Hat
Red Hat Directory Server 12.2 E4S for RHEL 9
Red Hat
Red Hat Directory Server 12.4 E4S for RHEL 9
Red Hat
Red Hat Directory Server 13.2
Subsystems
OT Supporting Infrastructure
Sectors
Multiple
What to Know
An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c. (NVD)
What to Do
Monitor Red Hat's web page for any future patch releases.