Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
389-ds-base can be tricked into memory errors
published 3 months ago
Summary
The 389 Directory Server software packages for AlmaLinux may mishandle specially crafted network messages, causing it to write beyond its memory limits or miscalculate data sizes. This could lead to crashes or allow an attacker to take control of the server. Apply the latest updates for all 389-ds-base packages to fix the problem.
What to do
- Update almalinux 389-ds-base to version 2.6.1-12.el9_6.tuxcare.els3.
- Update almalinux 389-ds-base-devel to version 2.6.1-12.el9_6.tuxcare.els3.
- Update almalinux 389-ds-base-libs to version 2.6.1-12.el9_6.tuxcare.els3.
- Update almalinux 389-ds-base-snmp to version 2.6.1-12.el9_6.tuxcare.els3.
- Update almalinux python3-lib389 to version 2.6.1-12.el9_6.tuxcare.els3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.6 | almalinux | 389-ds-base |
< 2.6.1-12.el9_6.tuxcare.els3 Fix: upgrade to 2.6.1-12.el9_6.tuxcare.els3
|
| TuxCare:AlmaLinux:9.6 | almalinux | 389-ds-base-devel |
< 2.6.1-12.el9_6.tuxcare.els3 Fix: upgrade to 2.6.1-12.el9_6.tuxcare.els3
|
| TuxCare:AlmaLinux:9.6 | almalinux | 389-ds-base-libs |
< 2.6.1-12.el9_6.tuxcare.els3 Fix: upgrade to 2.6.1-12.el9_6.tuxcare.els3
|
| TuxCare:AlmaLinux:9.6 | almalinux | 389-ds-base-snmp |
< 2.6.1-12.el9_6.tuxcare.els3 Fix: upgrade to 2.6.1-12.el9_6.tuxcare.els3
|
| TuxCare:AlmaLinux:9.6 | almalinux | python3-lib389 |
< 2.6.1-12.el9_6.tuxcare.els3 Fix: upgrade to 2.6.1-12.el9_6.tuxcare.els3
|
Original advisory text
389-ds-base: Fix of 2 CVEs
- CVE-2026-11610: fix heap buffer overflow in sasl_io_recv via oversized unencrypted UNBIND
- CVE-2026-11774: fix integer overflow in sasl_io_start_packet packet length handling
- CVE-2026-11774: fix integer overflow in sasl_io_start_packet packet length handling
References
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1783596522.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-11610 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-11774 Vendor Advisory
Timeline
Published9 Jul 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1783596522 · OSV
Track software like this
Free during beta