Red Hat Product Errata RHSA-2026:36209 - Security Advisory Issued: 2026-07-07 Updated: 2026-07-07 RHSA-2026:36209 - Security Advisory Overview Updated Packages Synopsis Important: redhat-ds:12 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for the redhat-ds:12 module is now available for Red Hat Directory Server 12.4 E4S for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages for server administration. Security Fix(es): 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610) 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Directory Server - 4 years of updates 12 for RHEL 9.4 x86_64 Fixes BZ - 2484414 - CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND BZ - 2484916 - CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow CVEs CVE-2026-11610 CVE-2026-11774 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Directory Server - 4 years of updates 12 for RHEL 9.4 SRPM 389-ds-base-2.4.5-24.module+el9dsrv+24459+87716c2d.src.rpm SHA-256: a3d144af0034ea258ace580c3094756cce4734a86ace5f6a0a4a6de912b8687c x86_64 389-ds-base-2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64.rpm SHA-256: 2197efebcf55dd9e4ec114b5ea8a5566ca94e0337e640e208f1ee2f7f3078b2b 389-ds-base-debuginfo-2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64.rpm SHA-256: 821602e23aa35f00c06b9f8cfaa8dcc5a829e34beaba70d918fb3b818f739f0f 389-ds-base-debugsource-2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64.rpm SHA-256: 0facda27492b5ae9219fe17a37f13f902ead83cb2c1603a5ffa93ccf3916a9c0 389-ds-base-devel-2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64.rpm SHA-256: 27c500cb906e6ca541c1ee379eff377ae4fd4f832dc8008640af93d48e661d44 389-ds-base-libs-2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64.rpm SHA-256: b33f5fa478dd1dad3a18d20781f10c96e4318d968bd0ccc50dc826510df308ea 389-ds-base-libs-debuginfo-2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64.rpm SHA-256: ccc140c94f1f852a5b91eaa8ffc74767f8dad3d467fc91dd58667852c61e4853 389-ds-base-snmp-2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64.rpm SHA-256: ee97d4fddd8b7b59a56c6617fdb3b725bdcec1477d696112611ebdc04945da98 389-ds-base-snmp-debuginfo-2.4.5-24.module+el9dsrv+24459+87716c2d.x86_64.rpm SHA-256: 77b85445e80cc808f4864f29e43d7c6a9ac489e324c3e655f5e726348a323f06 cockpit-389-ds-2.4.5-24.module+el9dsrv+24459+87716c2d.noarch.rpm SHA-256: 98175458ff3f9ef3afd5b8f448da643f0a6258f0c05af540e80a993f930e6afd python3-lib389-2.4.5-24.module+el9dsrv+24459+87716c2d.noarch.rpm SHA-256: 9556f5ccfde691993abe26eec3c1e5b09c903aa2d83e29b62a2001fea9f7f0d6 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .