389-ds-base: Batch of Four Vulnerabilities Includes Heap Overflow and Crypto Weaknesses
Four vulnerabilities affecting 389 Directory Server (389-ds-base) were disclosed together, ranging from critical heap overflows to cryptographic weaknesses.
Key findings
- Four vulnerabilities in 389-ds-base disclosed between July 7-8, 2026.
- Includes an important heap buffer overflow in SASL UNBIND (CVE-2026-11610).
- Two moderate vulnerabilities: heap overflow in DN normalization and weak encryption IV.
- Low severity issue found in PBKDF2-SHA256 password verification timing.
On July 7-8, 2026, a batch of four vulnerabilities was disclosed for 389 Directory Server (389-ds-base), a widely used open-source identity management solution. The vulnerabilities, ranging in severity from low to important, were reported by multiple sources and highlight potential weaknesses in password verification, attribute encryption, and buffer handling within the directory server.
One of the most critical issues, CVE-2026-11610, is a heap buffer overflow vulnerability in the sasl_io_recv() function, triggered by padded SASL UNBIND operations. This vulnerability carries a CVSSv3 score of 8.8, classifying it as important. Heap buffer overflows can lead to denial-of-service conditions or, in some cases, arbitrary code execution, making this a significant concern for administrators.
Two moderate severity vulnerabilities were also disclosed. CVE-2026-14940 involves a heap buffer overflow in the DN normalization process when handling quoted multivalued RDNs, with a CVSSv3 score of 5.3. Additionally, CVE-2026-14969 addresses a weakness in attribute encryption, specifically a static initialization vector used in AES-CBC/3DES-CBC encryption, rated at 4.4 CVSSv3. The use of static initialization vectors can weaken encryption, potentially allowing attackers to decrypt sensitive data.
Finally, a low severity vulnerability, CVE-2026-15041, was identified. This issue stems from a non-constant-time comparison in the PBKDF2-SHA256 password verification process. While rated low (CVSSv3 3.7), such timing side-channel vulnerabilities can sometimes be exploited to infer password information over time.
The disclosure of these vulnerabilities together suggests a coordinated effort to report security flaws affecting 389-ds-base. Administrators are advised to review the specific details of each CVE and apply any available patches or mitigations provided by the 389 Directory Server project to secure their deployments. The range of issues, from critical buffer overflows to cryptographic weaknesses, underscores the importance of maintaining up-to-date and securely configured directory services.