Executive brief
A security vulnerability has been identified in the 389 Directory Server, a core component used for managing user identities and network resources in enterprise environments like FreeIPA and Red Hat Identity Management. An authenticated user or service can send a specially crafted request that crashes the server, leading to a total denial of service. This could disrupt login services and organizational operations across the network.
Technical details
A heap-based buffer overflow (CWE-122) exists in the sasl_io_recv() function within sasl_io.c of 389-ds-base. The vulnerability is triggered after a successful SASL bind with integrity protection (SSF > 0), where the server fails to perform a bounds check when copying data into a fixed 512-byte heap receive buffer. An authenticated attacker can send a specially crafted, oversized LDAP UNBIND packet containing up to 2MB of data, overflowing the buffer and causing a process crash. This affects deployments using GSSAPI (Kerberos) or DIGEST-MD5, including FreeIPA and Red Hat Identity Management, where any domain user or enrolled host can trigger the flaw.
Affected products
- Red Hat 389-ds-base 1.3.2 and later
- Red Hat Red Hat Directory Server 11, 12
- Red Hat Red Hat Enterprise Linux 6, 7, 8, 9, 10
Timeline
- 2026-06-03: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-07: advisory: CVE published by Red Hat and NVD