Red Hat Security Advisory

RHSA-2026:64791

389-ds:1.4 security, bug fix, and enhancement update

Released 2026-09-08 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) 389-ds-base-1.4.3.39-28.module+el8.10.0+24822+205d20dc.aarch64::389-ds:1.4, 389-ds-base-1.4.3.39-28.module+el8.10.0+24822+205d20dc.ppc64le::389-ds:1.4, 389-ds-base-1.4.3.39-28.module+el8.10.0+24822+205d20dc.s390x::389-ds:1.4 +19

Fixes 4 records

TI-2026-15471 CVE-2026-18922 · GHSA-pr87-24g5-hphv

Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8

MEDIUM 44

A flaw was found in 389 Directory Server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0056 Published 2026-09-07 Partial fix · 8060020260908152739.0ca98e7e, 8080020260903102346.f969626e +15 CWE-287

TI-2026-53505 CVE-2026-76560 · GHSA-g4xg-g9jg-549h

389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn

MEDIUM 40

A flaw was found in 389 Directory Server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00556 Published 2026-09-07 Partial fix · 8060020260908152739.0ca98e7e, 8080020260903102346.f969626e +15 CWE-863

TI-2026-15160 CVE-2026-18453 · GHSA-42wr-8m7m-5j62

NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8

MEDIUM 40

A flaw was found in 389 Directory Server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00847 Published 2026-09-07 Partial fix · 8060020260908152739.0ca98e7e, 8080020260903102346.f969626e +15 CWE-476

TI-2026-15090 CVE-2026-18355 · GHSA-r5vv-79fp-2427

Integer underflow in Red Hat Directory Server 11.5 E4S for RHEL 8

LOW 36

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base).

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00837 Published 2026-09-07 Partial fix · 8060020260908152739.0ca98e7e, 8080020260903102346.f969626e +15 CWE-191