CVE-2026-18355
HighCVSS 7.5Summary
A heap buffer overflow in the SASL I/O layer of 389 Directory Server. In sasl_io_start_packet(), the wrapped-record length is only validated against an upper bound. A small wire length causes an unsigned underflow, leading to a read of about 4 GiB into a 1024-byte heap buffer. A remote authenticated attacker after a successful SASL bind with integrity protection can cause denial of service or potentially remote code execution.
Risk Assessment
An attacker could crash the server or gain control over it, posing a serious threat to confidentiality and availability of directory services.
Recommendation
Apply patches from the vendor for 389-ds-base. Restrict access to the LDAP server and enforce strong authentication to reduce the risk of exploitation.
Other vulnerabilities in 389 Directory Server
See all- CVE-2026-18453High
A missing NULL pointer check in the paged results handling of op_shared_search in 389 Directory Server. An unauthenticated remote attacker can crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.
- CVE-2026-76560High
A flaw in 389 Directory Server in the SELFDN ACI bind-rule evaluator. An anonymous LDAP client's empty bind DN is incorrectly matched against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended for authenticated identities. This can allow anonymous clients to perform operations like adding or modifying entries that should be restricted to specific authenticated users.
- CVE-2015-1854High
389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.
- CVE-2016-5416High
389 Directory Server in Red Hat Enterprise Linux 6 and 7 allows remote attackers to read the default Access Control Instructions.
- CVE-2016-4992High
The 389 Directory Server in Red Hat Enterprise Linux 6 and 7 allows remote attackers to infer the existence of RDN component objects.
- CVE-2016-0741High
In 389 Directory Server (formerly Fedora Directory Server) versions 1.3.4.x before 1.3.4.7, a vulnerability allows remote attackers to cause a denial of service through an abnormally closed connection, leading to an infinite loop and connection blocking.
- CVE-2015-3230High
389 Directory Server (formerly Fedora Directory Server) before version 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, allowing remote attackers to use a disabled cipher.
- CVE-2026-18922Critical
In 389 Directory Server, during SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.
- CVE-2016-5405Critical
The 389 Directory Server in Red Hat Enterprise Linux (Desktop, HPC Node, Server, Workstation) versions 6 and 7 allows remote attackers to obtain user passwords.
- CVE-2026-19404Medium
A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled (the default), or any authenticated low-privilege user to invoke them otherwise. This allows removal of a replica ID from replication metadata, purging of changelog records, and interruption of administrator-initiated cleanup, which can leave replication inconsistent or unavailable.
Original NVD description (English source)
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an upper bound. A small wire length (0, 1, or 2) produces an encrypted_buffer_count below the already-consumed encrypted_buffer_offset, causing an unsigned subtraction underflow in sasl_io_read_packet(). PR_Recv is then requested to read approximately 4 GiB into a 1024-byte heap buffer, resulting in a heap buffer overflow with attacker-controlled content. After a successful SASL bind with integrity protection (SSF > 0), a remote authenticated attacker can cause a denial of service or potentially achieve remote code execution. This flaw is distinct from CVE-2026-11774, whose fix only guards against upper-bound overflow.