RHSA-2026:64784CriticalCVSS 9.8

Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

Published
September 8, 2026
Last Modified
September 8, 2026

🔗 CVE IDs covered (5)

CVE-2026-18355 →CVE-2026-18453 →CVE-2026-18922 →CVE-2026-76560 →CVE-2026-78701 →

📋 Description

CVE-2026-18355 — 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() CVE-2026-18453 — 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search CVE-2026-18922 — 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property CVE-2026-76560 — 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN CVE-2026-78701 — 389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS

🎯 Affected products52

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • 389-ds-base-0:2.8.0-10.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • 389-ds-base-0:2.8.0-10.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • 389-ds-base-0:2.8.0-10.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • 389-ds-base-0:2.8.0-10.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • 389-ds-base-0:2.8.0-10.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • 389-ds-base-debuginfo-0:2.8.0-10.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • 389-ds-base-debuginfo-0:2.8.0-10.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • 389-ds-base-debuginfo-0:2.8.0-10.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • 389-ds-base-debuginfo-0:2.8.0-10.el9_8.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • 389-ds-base-debuginfo-0:2.8.0-10.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • 389-ds-base-debuginfo-0:2.8.0-10.el9_8.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • 389-ds-base-debuginfo-0:2.8.0-10.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • 389-ds-base-debuginfo-0:2.8.0-10.el9_8.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • 389-ds-base-debugsource-0:2.8.0-10.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • 389-ds-base-debugsource-0:2.8.0-10.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • 389-ds-base-debugsource-0:2.8.0-10.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • 389-ds-base-debugsource-0:2.8.0-10.el9_8.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • 389-ds-base-debugsource-0:2.8.0-10.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • 389-ds-base-debugsource-0:2.8.0-10.el9_8.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • 389-ds-base-debugsource-0:2.8.0-10.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • 389-ds-base-debugsource-0:2.8.0-10.el9_8.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • 389-ds-base-devel-0:2.8.0-10.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • 389-ds-base-devel-0:2.8.0-10.el9_8.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • 389-ds-base-devel-0:2.8.0-10.el9_8.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • 389-ds-base-devel-0:2.8.0-10.el9_8.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • 389-ds-base-libs-0:2.8.0-10.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • 389-ds-base-libs-0:2.8.0-10.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • 389-ds-base-libs-0:2.8.0-10.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +22 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Administrators can restrict nsslapd-allowed-sasl-mechanisms to only the mechanisms actually required (e.g. GSSAPI, EXTERNAL, GSS-SPNEGO), excluding PLAIN. Since the exploit chain requires the first bind attempt to be a failed SASL PLAIN bind as cn=Directory Manager, removing PLAIN from the allowed mechanism list prevents that step entirely — this blocks both the originally reported variant (valid low-privileged account) and the zero-credential SASL ANONYMOUS variant, since both depend on the same initial PLAIN bind to plant the stale identity. Workaround: Until a fix is available, review all ACIs using userattr="...#SELFDN" bind rules and confirm the target attribute cannot be set to an empty value, or add an explicit authmethod restriction to the ACI to prevent anonymous binds from satisfying the check. Where anonymous binds are not required, disabling anonymous access to the directory removes the attack surface entirely. Workaround: To mitigate this issue, restrict network access to the 389-ds-base service to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the LDAP ports (typically 389 for LDAP and 636 for LDAPS) to known, authorized IP addresses or subnets. Example using `firewalld`: ```bash # firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_OR_SUBNET>" port port="389" protocol="tcp" accept' # firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_OR_SUBNET>" port port="636" protocol="tcp" accept' # firewall-cmd --reload ``` Replace `<TRUSTED_IP_OR_SUBNET>` with the actual IP addresses or network ranges of your trusted clients. This action may impact legitimate clients if not configured correctly. A service restart is not required for firewall changes to take effect.

🔗 References (8)