Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
389-ds-base can cause memory buffer overflow
published 6 months ago
Summary
The 389-ds-base package uses a Rust library that can pass an unchecked data size to OpenSSL, potentially writing past the end of a memory buffer. This could lead to crashes or allow unintended code to run. Upgrade the package to a version that includes the fix as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | 389-ds-base | <= 3.1.1-12 |
Original advisory text
CVE-2026-41898 affecting package 389-ds-base 3.1.1-12
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_stateless_cookie_generate_cb forwarded the user closure's returned usize directly to OpenSSL without checking it against the &mut [u8] that was handed to the closure. This can lead to buffer overflows and other unintended consequences. This vulnerability is fixed in 0.10.78.
References
Timeline
Published24 Apr 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-84606 · OSV
Track software like this
Free during beta