CVE-2026-14940

389-ds-base versions before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.

A flaw in 389-ds-base, in the Cockpit 389 Console's LDAP editor. An LDAP entry's DN is embedded into a shell command without proper escaping. A user with delegated privileges could craft a malicious DN with shell metacharacters, leading to command execution with root privileges when viewed by an administrator.

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the SASL UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server.

A double-free flaw was found in 389-ds-base in the get_ldapmessage_controls_ext() function. An unauthenticated remote attacker can trigger it with a single BIND request carrying a critical Session Tracking control, leading to heap corruption and potential denial of service.

A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation.

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks.

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). An authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that overflows a 512-byte heap receive buffer without bounds checking, causing a denial of service (server crash).

An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). Adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data.

In 389-ds-base, the get_ldapmessage_controls_ext() function does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a crafted request with hundreds of thousands of minimal controls, causing excessive CPU consumption and heap allocation.

A heap buffer overflow vulnerability was found in the 389-ds-base server in the `schema_attr_enum_callback` function within `schema.c`. The flaw is due to incorrect buffer size calculation that sums alias string lengths without accounting for formatting characters, which can cause a heap overflow when processing many aliases.