Is CVE-2026-11610 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11610 being exploited in the wild.

How severe is CVE-2026-11610?

High severity, with a CVSS score of 8.8, published 7 July 2026.

Which products and versions are affected?

Red Hat 389-Ds-Base 1.3.2 and later.

Is there a fix for CVE-2026-11610?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11610 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-11610?

Check whether you run Red Hat 389-Ds-Base at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11610: Red Hat 389-ds-base heap buffer overflow in sasl_io_recv

CVE-2026-11610 · Severity: high · CVSS 8.8 · Published 2026-07-07

A security vulnerability has been identified in the 389 Directory Server, a core component used for managing user identities and network resources in enterprise environments like FreeIPA and Red Hat Identity Management. An authenticated user or service can send a specially crafted request that crashes the server, leading to a total denial of service. This could disrupt login services and organizational operations across the network.

Technologies: Red Hat 389-Ds-Base. Vendors: Red Hat.

Quick answers

Is CVE-2026-11610 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11610 being exploited in the wild.
How severe is CVE-2026-11610?: High severity, with a CVSS score of 8.8, published 7 July 2026.
Which products and versions are affected?: Red Hat 389-Ds-Base 1.3.2 and later.
Is there a fix for CVE-2026-11610?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11610 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-11610?: Check whether you run Red Hat 389-Ds-Base at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) exists in the sasl_io_recv() function within sasl_io.c of 389-ds-base. The vulnerability is triggered after a successful SASL bind with integrity protection (SSF > 0), where the server fails to perform a bounds check when copying data into a fixed 512-byte heap receive buffer. An authenticated attacker can send a specially crafted, oversized LDAP UNBIND packet containing up to 2MB of data, overflowing the buffer and causing a process crash. This affects deployments using GSSAPI (Kerberos) or DIGEST-MD5, including FreeIPA and Red Hat Identity Management, where any domain user or enrolled host can trigger the flaw.

Affected products

Red Hat 389-ds-base 1.3.2 and later
Red Hat Red Hat Directory Server 11, 12
Red Hat Red Hat Enterprise Linux 6, 7, 8, 9, 10

Timeline

2026-06-03: disclosed: Initial report in Red Hat Bugzilla
2026-07-07: advisory: CVE published by Red Hat and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.