CVE-2026-11610: 389 Directory Server SASL Heap Buffer Overflow Denial of Service

Technical summary

The vulnerability resides in the sasl_io_recv() function within sasl_io.c of 389-ds-base. The flaw is a heap buffer overflow occurring after successful SASL authentication with SSF > 0 (security strength factor indicating integrity/confidentiality protection is active). An attacker sends an oversized LDAP UNBIND packet that is copied into a fixed 512-byte heap buffer without bounds validation, permitting approximately 2 megabytes of controlled data to overflow the allocation. This corrupts adjacent heap memory and typically results in process termination. The vulnerable code path has persisted since 389-ds-base version 1.3.2 (circa 2013) and was not remediated by the separate CVE-2025-14905 fix, which addressed a different heap overflow in schema.c.

Business impact

This vulnerability enables authenticated denial of service attacks against directory infrastructure. Organizations using FreeIPA or Red Hat Identity Management face operational disruption when any domain user, service account, or enrolled system with valid Kerberos credentials triggers the flaw. Recovery requires manual server restart. In environments where directory services underpin authentication, account management, and policy distribution, sustained exploitation could degrade user access and system provisioning workflows. The attacker requires only valid credentials—no privilege escalation or additional exploitation chain is necessary.

Affected systems

389 Directory Server (389-ds-base) is affected, particularly in deployments integrated with FreeIPA or Red Hat Identity Management. The vulnerability is present in 389-ds-base 1.3.2 and subsequent versions through the current release. Verify specific vulnerable version ranges and patched releases in the official Red Hat security advisory. Red Hat Identity Management customers should prioritize assessment of their deployment scale and credential distribution scope.

Exploitability

Exploitability is straightforward for any entity holding valid LDAP credentials (domain user, service account, enrolled host with Kerberos ticket in FreeIPA/IdM). No special attack tools or code execution are required—a crafted LDAP packet can be transmitted via standard protocol mechanisms after authentication. Network accessibility is required, but the attack occurs post-authentication over the normal LDAP port. The low complexity and minimal prerequisites make this a practical denial-of-service vector for insider threats or compromised account scenarios.

Remediation

Apply the security patch provided by Red Hat for 389-ds-base. Verify the patched version number against the official security advisory to ensure the fix addresses sasl_io.c, not just the separately patched schema.c overflow. Organizations should coordinate patching with directory service maintenance windows to minimize authentication service downtime. No workarounds are available short of restricting SASL integrity protection, which would weaken authentication security.

Patch guidance

Obtain and deploy the patched 389-ds-base version from Red Hat's package repositories. Test the update in a non-production environment first, particularly if FreeIPA or Red Hat Identity Management relies on this service for critical infrastructure. Verify the patch release notes explicitly mention the sasl_io.c overflow fix to confirm the correct version addresses this CVE. After patching, restart affected directory server instances and validate authentication and replication functionality before returning to production.

Detection guidance

Monitor directory server logs for unexpected UNBIND packets or connection resets that correlate with SASL authentication events. Heap corruption may be detectable via OS-level memory sanitizers or debug assertions if enabled in your build. Check system logs for segmentation fault errors from the ns-slapd process. Network-based detection is challenging without deep packet inspection of LDAP protocol details; prioritize log correlation on the server side. Track failed or anomalous authentication patterns that precede service crashes.

Why prioritize this

CVSS 8.8 (HIGH) reflects the combination of network accessibility, requirement for valid credentials only (post-authentication), and direct denial of service impact. While the attack requires authentication, compromise of any domain user or service account credential—common in large environments—enables exploitation. For organizations where directory services underpin identity infrastructure, availability is critical. The 13-year existence of the vulnerable code path and its survival of a related patch indicate mature exploitation potential and increased likelihood of external awareness.

Risk score, explained

The score of 8.8 reflects HIGH severity: the vulnerability is network-accessible (AV:N), requires low attack complexity post-authentication (AC:L), needs valid credentials (PR:L), causes high impact to availability via denial of service (A:H), and also impacts confidentiality and integrity through memory corruption (C:H/I:H). The lack of user interaction (UI:N) and universal scope (S:U) increase the score. However, the hard prerequisite of valid authentication prevents a critical rating. In environments with thousands of user credentials or service accounts, the practical impact escalates substantially.

Frequently asked questions