CVE-2026-16560

389-ds-base versions before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the SASL UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server.

A double-free flaw was found in 389-ds-base in the get_ldapmessage_controls_ext() function. An unauthenticated remote attacker can trigger it with a single BIND request carrying a critical Session Tracking control, leading to heap corruption and potential denial of service.

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks.

A heap-buffer-overflow vulnerability was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name (RDN), the server can write past the end of a heap allocation while sorting RDN attribute-value pairs. An unauthenticated remote attacker can trigger this condition by sending an LDAP operation whose DN reaches the DN normalization routine, such as a search with a crafted base DN.

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). An authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that overflows a 512-byte heap receive buffer without bounds checking, causing a denial of service (server crash).

An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). Adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data.

In 389-ds-base, the get_ldapmessage_controls_ext() function does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a crafted request with hundreds of thousands of minimal controls, causing excessive CPU consumption and heap allocation.

A heap buffer overflow vulnerability was found in the 389-ds-base server in the `schema_attr_enum_callback` function within `schema.c`. The flaw is due to incorrect buffer size calculation that sums alias string lengths without accounting for formatting characters, which can cause a heap overflow when processing many aliases.

A flaw in the 389-ds-base LDAP Server occurs when the return value of a function is not checked during a Modify DN operation, leading to a NULL pointer dereference. A privileged user performing a MODDN operation after a failed operation can cause a Denial of Service (DoS) or system crash.