TI-2026-15284 CVE-2026-18651 · GHSA-q924-9ph6-5h92
Improper authentication in Red Hat Directory Server 11
Priority LOW 24
A flaw was found in 389 Directory Server.
Vulnerabilities
42 records
TI-2026-10157 CVE-2026-11770 · GHSA-r7mx-568f-jgg3
389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check
Priority LOW 39
A flaw was found in 389 Directory Server.
TI-2026-13229 CVE-2026-15722 · GHSA-5gg4-m865-6qwr
Stack-based buffer overflow in Red Hat Directory Server 11.5 E4S for RHEL 8
Priority MEDIUM 40
A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base).
TI-2026-12660 CVE-2026-15041 · GHSA-j5fh-pqqw-m384
389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification
Priority LOW 18
A flaw was found in 389 Directory Server.
TI-2026-12603 CVE-2026-14969 · GHSA-9458-4323-hx4r
389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption
Priority LOW 19
A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to det…
TI-2026-12582 CVE-2026-14940 · GHSA-868f-j5w9-5jgm
389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn
Priority LOW 31
A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base).
TI-2026-10178 CVE-2026-11791 · GHSA-gxp7-cx54-gr2m
389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht()
Priority LOW 23
A flaw was found in 389 Directory Server.
TI-2026-10751 CVE-2026-12528 · GHSA-jf4x-778m-8cj9
389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()
Priority LOW 24
A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c.
TI-2026-10177 CVE-2026-11790 · GHSA-5cpf-527w-96rp
389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service
Priority LOW 22
A flaw was found in 389 Directory Server.
TI-2026-10176 CVE-2026-11789 · GHSA-jjqx-m459-2x33
389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash
Priority LOW 29
A flaw was found in 389 Directory Server.
TI-2026-10175 CVE-2026-11788 · GHSA-x2wj-4r98-4867
389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser
Priority LOW 34
A flaw was found in 389 Directory Server.
TI-2026-10174 CVE-2026-11787 · GHSA-wjcg-9hh3-8323
389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing
Priority LOW 27
A flaw was found in 389 Directory Server.
TI-2026-10172 CVE-2026-11785 · GHSA-8v22-4r9h-6m6j
389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handler
Priority LOW 19
A flaw was found in 389 Directory Server.
TI-2026-10173 CVE-2026-11786 · GHSA-8969-43cc-8p5h
389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()
Priority LOW 28
A flaw was found in 389 Directory Server.
TI-2026-10024 CVE-2026-11611 · GHSA-m7g9-hmx3-c8f9
389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions
Priority LOW 28
A flaw was found in 389 Directory Server.
TI-2026-07965 CVE-2026-9064 · GHSA-7r3c-wfgh-x96c
Resource allocation without limits in 389-ds-base
Priority MEDIUM 40
A flaw was found in 389-ds-base.
TI-2024-05784 CVE-2024-6237 · GHSA-2fpj-qhmc-jpvc
389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request
Priority LOW 37
A flaw was found in the 389 Directory Server.
TI-2024-00983 CVE-2024-1062 · GHSA-6v6c-gc45-x65c
389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)
Priority LOW 25
A heap overflow flaw was found in 389-ds-base.
TI-2023-00999 CVE-2023-1055 · GHSA-w8wv-xqxw-7vgx
Information disclosure in Red Hat Directory Server
Priority LOW 24
A flaw was found in RHDS 11 and RHDS 12.
TI-2022-02643 CVE-2022-2850 · GHSA-6c63-4574-7p9f
NULL pointer dereference in 389-ds-base
Priority MEDIUM 62
A flaw was found In 389-ds-base.
TI-2022-01808 CVE-2022-1949 · GHSA-x847-vxvj-g6rj
Authorization bypass in 389-ds-base
Priority LOW 36
An access control bypass vulnerability found in 389-ds-base.
TI-2020-18037 CVE-2020-35518 · GHSA-vg4h-9m5m-rchq
Information disclosure in 389-ds-base
Priority LOW 27
When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not.
TI-2010-03137 CVE-2010-3282 · GHSA-c9g4-pfp3-j9qm
Cleartext storage of sensitive information in Red Hat 389 Directory Server
Priority LOW 16
389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is enabled, logs the Directory Manager password (nsslapd-rootpw) in cleartext when c…
TI-2010-02131 CVE-2010-2222 · GHSA-r732-c3fc-99gm
NULL pointer dereference in Red Hat Directory Server
Priority LOW 36
The _ger_parse_control function in Red Hat Directory Server 8 and the 389 Directory Server allows attackers to cause a denial of service (NULL pointer dereference) via a crafted search query.
TI-2014-02886 CVE-2014-3562 · GHSA-6vvf-j83f-44mh
Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows…
Priority LOW 27
Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory.