Is CVE-2026-11774 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11774 being exploited in the wild.

How severe is CVE-2026-11774?

High severity, with a CVSS score of 7.6, published 11 June 2026.

Which products and versions are affected?

389 Directory Server Project 389-ds-base All versions prior to fix; FreeIPA Project FreeIPA; Red Hat Red Hat Identity Management.

Is there a fix for CVE-2026-11774?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11774 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-11774?

Check whether you run FreeIPA Project FreeIPA or Red Hat Identity Management. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11774: 389 Directory Server Integer Overflow in SASL I/O layer

CVE-2026-11774 · Severity: high · CVSS 7.6 · Published 2026-06-11

A security vulnerability exists in the 389 Directory Server, a service used to manage user identities and access across corporate networks. An attacker with basic user credentials can send a specially crafted network packet to crash the server or potentially take full control of the system. This could lead to a total service outage or unauthorized access to sensitive identity data in environments like FreeIPA and Red Hat Identity Management.

Technologies: FreeIPA Project FreeIPA. Vendors: FreeIPA Project, Red Hat.

Quick answers

Is CVE-2026-11774 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11774 being exploited in the wild.
How severe is CVE-2026-11774?: High severity, with a CVSS score of 7.6, published 11 June 2026.
Which products and versions are affected?: 389 Directory Server Project 389-ds-base All versions prior to fix; FreeIPA Project FreeIPA; Red Hat Red Hat Identity Management.
Is there a fix for CVE-2026-11774?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11774 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-11774?: Check whether you run FreeIPA Project FreeIPA or Red Hat Identity Management. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability exists in the SASL I/O layer of 389-ds-base within the `sasl_io_start_packet()` function in `sasl_io.c`. By providing a crafted 4-byte SASL packet length prefix (0xFFFFFFFC), the addition of `sizeof(uint32_t)` causes an unsigned integer wraparound to zero. This bypasses the `nsslapd-maxsasliosize` limit check. Subsequent processing in `sasl_io_read_packet()` results in a buffer underflow calculation, causing NSPR to read up to 2MB of attacker-controlled data into a 1024-byte heap buffer. Exploitation requires a successful SASL bind (e.g., via Kerberos or DIGEST-MD5) with integrity protection enabled (SSF > 0). While the overflow can reliably cause a Denial of Service, Remote Code Execution has been demonstrated on older glibc versions (e.g., 2.28) via tcache poisoning.

Affected products

389 Directory Server Project 389-ds-base All versions prior to fix
FreeIPA Project FreeIPA
Red Hat Red Hat Identity Management

Timeline

2026-06-04: disclosed: Reported via Red Hat Bugzilla
2026-06-11: advisory: CVE published by Red Hat

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.