This security update addresses two high-severity vulnerabilities (CVE-2026-11610, CVSS 8.8, and CVE-2026-11774, CVSS 7.6) in the 389-ds-base component of Red Hat Directory Server 11. The flaws are heap buffer overflows and an integer overflow in the SASL handling code, which could be exploited via specially crafted SASL packets. The update is rated Important and applies to Red Hat Directory Server 11.7 E4S for RHEL 8.
Red Hat Product Errata RHSA-2026:36208 - Security Advisory Issued: 2026-07-07 Updated: 2026-07-07 RHSA-2026:36208 - Security Advisory Overview Updated Packages Synopsis Important: redhat-ds:11 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for the redhat-ds:11 module is now available for Red Hat Directory Server 11.7 E4S for RHEL 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages for server administration. Security Fix(es): 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610) 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Directory Server - 4 years of updates 11 for RHEL 8.8 x86_64 Fixes BZ - 2484414 - CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND BZ - 2484916 - CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow CVEs CVE-2026-11610 CVE-2026-11774 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Directory Server - 4 years of updates 11 for RHEL 8.8 SRPM 389-ds-base-1.4.3.34-16.module+el8dsrv+24461+e76d504b.src.rpm SHA-256: 0a4c935d770f4be46551e074311499c68e4407a42adfce8ead386f3616ac142f x86_64 389-ds-base-1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64.rpm SHA-256: 946bd902cfe4dcae6aea729cfab9c8c28494f740d61d872661f44804600d19aa 389-ds-base-debuginfo-1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64.rpm SHA-256: 07c3acdec6a5ce13d5bb5298048d2be274e390fd5a763b020292d6ba66e8e829 389-ds-base-debugsource-1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64.rpm SHA-256: 7a38683222398fac467dada713bd5392bec2c5908d404d0888f25e8c0c17a58c 389-ds-base-devel-1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64.rpm SHA-256: 586c8af63df5f1883c7b018e294c50abfb1c3e502ced2bc9915da9e90e834f68 389-ds-base-legacy-tools-1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64.rpm SHA-256: 389bb3d3148ecee3ec62f8f5283554818452b1b06ce29197122b047825801ce8 389-ds-base-legacy-tools-debuginfo-1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64.rpm SHA-256: 84eef1ef00e02707469929de034cef33b98eb917e7c8f997c68576428a9b9875 389-ds-base-libs-1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64.rpm SHA-256: 884f8ab4209b357b204a469cfe860be7b66150274dc9faa3933efe374d48e7c7 389-ds-base-libs-debuginfo-1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64.rpm SHA-256: 553129882a09d47f894a09bd8aedabf07eb3ac259454e80ee1001bcf3a0b104c 389-ds-base-snmp-1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64.rpm SHA-256: cc70511fa290b4168f19ff2314a29da5064501179df63d78447cc3092b863c54 389-ds-base-snmp-debuginfo-1.4.3.34-16.module+el8dsrv+24461+e76d504b.x86_64.rpm SHA-256: 90146e127e0bf5526677fcbbdcd0cf33e004c1046b6e6af8b1bf3ebbc385a70e cockpit-389-ds-1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch.rpm SHA-256: f91dde6f6e8cbf399eeaa3da7f067e5192576780d0d2c433322743eb333f5549 python3-lib389-1.4.3.34-16.module+el8dsrv+24461+e76d504b.noarch.rpm SHA-256: 96ca923bbdbc71110133533ad0b3631dc33062f7e336bf57533f6dec551cd7fd The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .