CVE-2026-86345

A flaw was found in 389-ds-base where an unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.

389-ds-base versions before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.

A flaw in 389-ds-base, in the Cockpit 389 Console's LDAP editor. An LDAP entry's DN is embedded into a shell command without proper escaping. A user with delegated privileges could craft a malicious DN with shell metacharacters, leading to command execution with root privileges when viewed by an administrator.

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the SASL UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server.

A double-free flaw was found in 389-ds-base in the get_ldapmessage_controls_ext() function. An unauthenticated remote attacker can trigger it with a single BIND request carrying a critical Session Tracking control, leading to heap corruption and potential denial of service.

A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation.

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks.

A heap-buffer-overflow vulnerability was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name (RDN), the server can write past the end of a heap allocation while sorting RDN attribute-value pairs. An unauthenticated remote attacker can trigger this condition by sending an LDAP operation whose DN reaches the DN normalization routine, such as a search with a crafted base DN.

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). An authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that overflows a 512-byte heap receive buffer without bounds checking, causing a denial of service (server crash).

An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). Adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data.