CVE-2026-11610: 389 Directory Server DoS Vulnerability

CVE-2026-11610 Overview

CVE-2026-11610 is a heap buffer overflow vulnerability in the SASL I/O layer of 389 Directory Server (389-ds-base). The flaw resides in the sasl_io_recv() function within sasl_io.c, where an oversized LDAP UNBIND packet is copied into a 512-byte heap receive buffer without a bounds check. After completing a SASL bind with integrity protection (SSF > 0), an authenticated attacker can overflow the buffer with up to approximately 2 megabytes of attacker-controlled data, causing the server to crash. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the earlier CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.

Critical Impact
In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can crash the directory server over the network after authenticating via GSSAPI.

Affected Products

389 Directory Server (389-ds-base) versions from 1.3.2 onward
FreeIPA deployments using vulnerable 389-ds-base builds
Red Hat Identity Management (IdM) — see Red Hat CVE Entry CVE-2026-11610

Discovery Timeline

2026-07-07 - CVE-2026-11610 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-11610

Vulnerability Analysis

The vulnerability is a classified heap buffer overflow ([CWE-122]) in the SASL I/O receive path of 389 Directory Server. When Simple Authentication and Security Layer (SASL) integrity or confidentiality protection is negotiated (Security Strength Factor greater than zero), inbound LDAP traffic is processed through sasl_io_recv() in sasl_io.c. The function copies incoming packet data into a fixed 512-byte heap-allocated receive buffer without validating the incoming length against the buffer size. An authenticated attacker can send an LDAP UNBIND request with a crafted length field indicating a payload of up to roughly 2 megabytes, causing adjacent heap memory to be overwritten with attacker-controlled bytes and triggering a denial of service.

Root Cause

The root cause is a missing bounds check in sasl_io_recv(). The function trusts the length value derived from the SASL-framed LDAP message and performs the copy into a statically sized 512-byte heap buffer, allowing an out-of-bounds write on the heap.

Attack Vector

Exploitation requires network access to the LDAP service and a valid authenticated SASL session with integrity protection enabled. In FreeIPA and Red Hat IdM environments, this authentication is available to any domain user with a Kerberos ticket, any enrolled host, or any service account using GSSAPI. Once bound with SSF greater than zero, the attacker sends a single oversized UNBIND packet, and the server process crashes without further interaction. The vulnerability requires no user interaction and operates entirely over the network.

No verified public proof-of-concept code is available. See the Red Hat Bugzilla Report #2484414 for further technical details.

Detection Methods for CVE-2026-11610

Indicators of Compromise

Unexpected termination or repeated crashes of the ns-slapd process shortly after a successful SASL bind
Core dumps from ns-slapd referencing sasl_io_recv in the crash backtrace
Directory server access logs showing a SASL bind with SSF > 0 immediately followed by an oversized UNBIND request and connection reset

Detection Strategies

Monitor 389-ds-base audit and access logs for abnormally large LDAP protocol data units following GSSAPI/SASL binds
Correlate Kerberos authentication events with subsequent directory server crashes to identify the originating principal
Track version and package inventory to identify hosts still running unpatched 389-ds-base builds

Monitoring Recommendations

Enable systemd or process-level monitoring on dirsrv@<instance> services and alert on unexpected restarts
Ingest 389-ds error logs and Kerberos KDC logs into a centralized SIEM for cross-source correlation
Alert on repeated LDAP client disconnects paired with ns-slapd segmentation fault entries in system journals

How to Mitigate CVE-2026-11610

Immediate Actions Required

Apply the Red Hat security errata for your platform, referenced in advisories such as RHSA-2026:36195 and RHSA-2026:36585
Inventory all FreeIPA and Red Hat IdM replicas and confirm each is running a patched 389-ds-base build
Restrict LDAP network exposure to trusted management networks where feasible

Patch Information

Red Hat has published multiple errata addressing CVE-2026-11610 across supported product streams. Consult the full list including RHSA-2026:36196, RHSA-2026:36197, RHSA-2026:36198, RHSA-2026:36200, RHSA-2026:36201, RHSA-2026:36202, RHSA-2026:36204, RHSA-2026:36205, RHSA-2026:36206, RHSA-2026:36208, RHSA-2026:36209, RHSA-2026:36641, RHSA-2026:36660, RHSA-2026:36670, and RHSA-2026:36671.

Workarounds

Disable SASL integrity and confidentiality layers where directory clients can safely operate without SSF > 0, eliminating the vulnerable code path
Limit which principals can authenticate to the directory server via host-based access control and Kerberos policies until patches are deployed
Place LDAP endpoints behind network segmentation so only trusted subnets can reach ports 389 and 636

bash

# Update 389-ds-base on Red Hat Enterprise Linux systems
sudo dnf update 389-ds-base
sudo systemctl restart dirsrv@<instance-name>

# Verify installed package version after patching
rpm -q 389-ds-base