# CVE-2026-11610: Red Hat 389-ds-base heap buffer overflow in sasl_io_recv

Source: https://junglewise.ai/threats/cve-2026-11610-red-hat-389-ds-base-heap-buffer-overflow-in-sasl-io-recv  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-11610 · Severity: high · CVSS 8.8 · Published 2026-07-07

A security vulnerability has been identified in the 389 Directory Server, a core component used for managing user identities and network resources in enterprise environments like FreeIPA and Red Hat Identity Management. An authenticated user or service can send a specially crafted request that crashes the server, leading to a total denial of service. This could disrupt login services and organizational operations across the network.

Technologies: [Red Hat 389-Ds-Base](https://junglewise.ai/threats/technologies/389-ds-base). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-11610 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11610 being exploited in the wild.

**How severe is CVE-2026-11610?** High severity, with a CVSS score of 8.8, published 7 July 2026.

**Which products and versions are affected?** Red Hat 389-Ds-Base 1.3.2 and later.

**Is there a fix for CVE-2026-11610?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11610 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11610?** Check whether you run Red Hat 389-Ds-Base at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow (CWE-122) exists in the sasl_io_recv() function within sasl_io.c of 389-ds-base. The vulnerability is triggered after a successful SASL bind with integrity protection (SSF > 0), where the server fails to perform a bounds check when copying data into a fixed 512-byte heap receive buffer. An authenticated attacker can send a specially crafted, oversized LDAP UNBIND packet containing up to 2MB of data, overflowing the buffer and causing a process crash. This affects deployments using GSSAPI (Kerberos) or DIGEST-MD5, including FreeIPA and Red Hat Identity Management, where any domain user or enrolled host can trigger the flaw.

## Affected products

- Red Hat 389-ds-base 1.3.2 and later
- Red Hat Red Hat Directory Server 11, 12
- Red Hat Red Hat Enterprise Linux 6, 7, 8, 9, 10

## Timeline

- 2026-06-03: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-07: advisory: CVE published by Red Hat and NVD

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-11610](https://access.redhat.com/security/cve/CVE-2026-11610)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2484414](https://bugzilla.redhat.com/show_bug.cgi?id=2484414)

## Related threats

- [389-ds-base NULL pointer dereference in ModifyDN](https://junglewise.ai/threats/cve-2026-117548-a-null-pointer-dereference-flaw-was-found-in-389-ds-base-this)
- [389-ds-base StartTLS plaintext buffer injection](https://junglewise.ai/threats/cve-2026-86345-a-flaw-was-found-in-389-ds-base-the-server-does-not-discard)
- [Red Hat 389-ds-base heap buffer overflow in rdn_av_swap](https://junglewise.ai/threats/cve-2026-16560-red-hat-389-ds-base-heap-buffer-overflow-in-rdn-av-swap)
- [Red Hat 389-ds-base Predictable IV in LDBM Attribute Encryption](https://junglewise.ai/threats/cve-2026-14969-red-hat-389-ds-base-predictable-iv-in-ldbm-attribute-encryption)
- [Red Hat 389-ds-base heap buffer overflow in schema_attr_enum_callback](https://junglewise.ai/threats/cve-2025-14905-red-hat-389-ds-base-heap-buffer-overflow-in-schema-attr-enum)