# CVE-2026-11774: 389 Directory Server Integer Overflow in SASL I/O layer

Source: https://junglewise.ai/threats/cve-2026-11774-389-directory-server-integer-overflow-in-sasl-i-o-layer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-11774 · Severity: high · CVSS 7.6 · Published 2026-06-11

A security vulnerability exists in the 389 Directory Server, a service used to manage user identities and access across corporate networks. An attacker with basic user credentials can send a specially crafted network packet to crash the server or potentially take full control of the system. This could lead to a total service outage or unauthorized access to sensitive identity data in environments like FreeIPA and Red Hat Identity Management.

Technologies: [FreeIPA Project FreeIPA](https://junglewise.ai/threats/technologies/freeipa). Vendors: [FreeIPA Project](https://junglewise.ai/threats/vendors/freeipa-project), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-11774 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11774 being exploited in the wild.

**How severe is CVE-2026-11774?** High severity, with a CVSS score of 7.6, published 11 June 2026.

**Which products and versions are affected?** 389 Directory Server Project 389-ds-base All versions prior to fix; FreeIPA Project FreeIPA; Red Hat Red Hat Identity Management.

**Is there a fix for CVE-2026-11774?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11774 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-11774?** Check whether you run FreeIPA Project FreeIPA or Red Hat Identity Management. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability exists in the SASL I/O layer of 389-ds-base within the `sasl_io_start_packet()` function in `sasl_io.c`. By providing a crafted 4-byte SASL packet length prefix (0xFFFFFFFC), the addition of `sizeof(uint32_t)` causes an unsigned integer wraparound to zero. This bypasses the `nsslapd-maxsasliosize` limit check. Subsequent processing in `sasl_io_read_packet()` results in a buffer underflow calculation, causing NSPR to read up to 2MB of attacker-controlled data into a 1024-byte heap buffer. Exploitation requires a successful SASL bind (e.g., via Kerberos or DIGEST-MD5) with integrity protection enabled (SSF > 0). While the overflow can reliably cause a Denial of Service, Remote Code Execution has been demonstrated on older glibc versions (e.g., 2.28) via tcache poisoning.

## Affected products

- 389 Directory Server Project 389-ds-base All versions prior to fix
- FreeIPA Project FreeIPA
- Red Hat Red Hat Identity Management

## Timeline

- 2026-06-04: disclosed: Reported via Red Hat Bugzilla
- 2026-06-11: advisory: CVE published by Red Hat

## References

- [https://access.redhat.com/security/cve/CVE-2026-11774](https://access.redhat.com/security/cve/CVE-2026-11774)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2484916](https://bugzilla.redhat.com/show_bug.cgi?id=2484916)
- [https://redhat.atlassian.net/browse/PSIRTSUPT-7600](https://redhat.atlassian.net/browse/PSIRTSUPT-7600)

## Related threats

- [Red Hat Identity Management Dogtag CA REST endpoint stack trace disclosure](https://junglewise.ai/threats/cve-2026-11873-red-hat-identity-management-dogtag-ca-rest-endpoint-stack-trace)
- [FreeIPA ipa-otpd off-by-one errors in OAuth2 handler](https://junglewise.ai/threats/cve-2026-14612-freeipa-ipa-otpd-off-by-one-errors-in-oauth2-handler)