Most recent entries from all

ALSA-2026:55423 — Important: 389-ds-base security update

Affected: AlmaLinux:9: 389-ds-base, AlmaLinux:9: 389-ds-base-devel, AlmaLinux:9: 389-ds-base-libs, AlmaLinux:9: 389-ds-base-snmp, AlmaLinux:9: python3-lib389

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

* 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check (CVE-2026-11770) * 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser (CVE-2026-11788) * 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing (CVE-2026-15722)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

EUVD-2026-354994

fkie_cve-2026-11788

A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.

GHSA-x2wj-4r98-4867

OESA-2026-3992 — 389-ds-base security update

Affected: openEuler:24.03-LTS-SP3: 389-ds-base

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fix(es):

A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and reads during ACI parsing. The function fails to validate that the ACI keyword has sufficient length after whitespace stripping, leading to a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An authenticated user with write access to the aci attribute could send a crafted ACI value to silently corrupt heap memory in the directory server process.(CVE-2026-12528)

RHSA-2026:55421 — Red Hat Security Advisory: 389-ds-base security update

389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing

RHSA-2026:55423 — Red Hat Security Advisory: 389-ds-base security update

RLSA-2026:55423 — Important: 389-ds-base security update

Affected: Rocky Linux:9: 389-ds-base

Security Fix(es):

* 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check (CVE-2026-11770)

* 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser (CVE-2026-11788)

* 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing (CVE-2026-15722)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-11788

Affected: Ubuntu:Pro:16.04:LTS: 389-ds-base, Ubuntu:Pro:18.04:LTS: 389-ds-base, Ubuntu:Pro:20.04:LTS: 389-ds-base, Ubuntu:22.04:LTS: 389-ds-base, Ubuntu:24.04:LTS: 389-ds-base, Ubuntu:25.10: 389-ds-base, Ubuntu:26.04:LTS: 389-ds-base

WID-SEC-W-2026-2854 — Red Hat Enterprise Linux (389-ds-base): Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um Informationen offenzulegen und um einen Denial-of-Service-Zustand zu verursachen.