What’s Vulnerable › Products

Red Hat 389 Directory Server vulnerabilities

25 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.

Check whether your Red Hat 389 Directory Server version is affected

Latest Red Hat 389 Directory Server vulnerabilities

• CVE-2026-18651 — 389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account (CVSS 5.4)
• CVE-2026-15722 — 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing (CVSS 7.5)
• CVE-2026-11770 — 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check (CVSS 7.5)
• CVE-2026-15041 — 389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification (CVSS 3.7)
• CVE-2026-14969 — 389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption (CVSS 4.4)
• CVE-2026-14940 — 389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn (CVSS 5.3)
• CVE-2026-11791 — 389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht() (CVSS 5.0)
• CVE-2026-12528 — 389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt() (CVSS 5.4)
• CVE-2026-11793 — 389-ds-base: 389-ds-base: stack buffer overflow in checkprefix() algorithm id parsing (CVSS 4.9)
• CVE-2026-11790 — 389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service (CVSS 4.9)
• CVE-2026-11789 — 389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash (CVSS 6.5)
• CVE-2026-11788 — 389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser (CVSS 7.5)
• CVE-2026-11787 — 389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing (CVSS 6.3)
• CVE-2026-11786 — 389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type() (CVSS 6.5)
• CVE-2026-11785 — 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handler (CVSS 4.3)
• CVE-2026-11611 — 389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions (CVSS 6.5)
• CVE-2026-9064 — 389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos) (CVSS 7.5)
• CVE-2024-6237 — 389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request (CVSS 6.5)
• CVE-2024-1062 — 389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr) (CVSS 5.5)
• CVE-2022-1949 — (CVSS 7.5)
• CVE-2022-0996 — (CVSS 6.5)
• CVE-2021-3514 — (CVSS 6.5)
• CVE-2020-35518 — (CVSS 5.3)
• CVE-2010-2222 — (CVSS 7.5)
• CVE-2018-10935 — (CVSS 6.5)