Red Hat Security Advisory

RHSA-2026:79217

redhat-ds:11 security, bug fix, and enhancement update

Released 2026-10-08 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Directory Server 11.5 E4S for RHEL 8 389-ds-base-1.4.3.34-9.module+el8dsrv+24847+c94540a6.src::redhat-ds:11, 389-ds-base-1.4.3.34-9.module+el8dsrv+24847+c94540a6.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.3.34-9.module+el8dsrv+24847+c94540a6.x86_64::redhat-ds:11 +5

Fixes 8 records

TI-2026-15471 CVE-2026-18922 · GHSA-pr87-24g5-hphv

Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8

MEDIUM 44

A flaw was found in 389 Directory Server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0056 Published 2026-09-07 Partial fix · 8060020260908152739.0ca98e7e, 8080020260903102346.f969626e +15 CWE-287

TI-2026-53505 CVE-2026-76560 · GHSA-g4xg-g9jg-549h

389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn

MEDIUM 40

A flaw was found in 389 Directory Server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00556 Published 2026-09-07 Partial fix · 8060020260908152739.0ca98e7e, 8080020260903102346.f969626e +15 CWE-863

TI-2026-15160 CVE-2026-18453 · GHSA-42wr-8m7m-5j62

NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8

MEDIUM 40

A flaw was found in 389 Directory Server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00847 Published 2026-09-07 Partial fix · 8060020260908152739.0ca98e7e, 8080020260903102346.f969626e +15 CWE-476

TI-2026-13229 CVE-2026-15722 · GHSA-5gg4-m865-6qwr

Stack-based buffer overflow in Red Hat Directory Server 11.5 E4S for RHEL 8

MEDIUM 40

A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0083 Published 2026-07-31 Partial fix · 8060020260908152739.0ca98e7e, 8080020260806114250.f969626e +14 CWE-121

TI-2026-16091 CVE-2026-19843 · GHSA-p34m-7cj2-q64p

389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor

LOW 39

A flaw was found in 389-ds-base.

CVSS 3.1HIGH 8.4 Network High privileges User interaction EPSS 0.0048 Published 2026-09-07 Partial fix · 8060020260908152739.0ca98e7e, 8080020260903102346.f969626e +7 CWE-78

TI-2026-10157 CVE-2026-11770 · GHSA-r7mx-568f-jgg3

389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

LOW 39

A flaw was found in 389 Directory Server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00527 Published 2026-07-31 Partial fix · 8060020260908152739.0ca98e7e, 8080020260806114250.f969626e +14 CWE-90

TI-2026-15090 CVE-2026-18355 · GHSA-r5vv-79fp-2427

Integer underflow in Red Hat Directory Server 11.5 E4S for RHEL 8

LOW 36

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base).

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00837 Published 2026-09-07 Partial fix · 8060020260908152739.0ca98e7e, 8080020260903102346.f969626e +15 CWE-191

TI-2026-10175 CVE-2026-11788 · GHSA-x2wj-4r98-4867

389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser

LOW 34

A flaw was found in 389 Directory Server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00561 Published 2026-06-09 Partial fix · 8060020260908152739.0ca98e7e, 8080020260806114250.f969626e +14 CWE-476