A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.

oracle_linux ELSA-2026-36195: ELSA-2026-36195:  389-ds-base security update (IMPORTANT)

redhat RHSA-2026:36209: RHSA-2026:36209: redhat-ds:12 security update (Important)

redhat RHSA-2026:36196: RHSA-2026:36196: 389-ds-base security update (Important)

redhat RHSA-2026:36200: RHSA-2026:36200: redhat-ds:11 security update (Important)

redhat RHSA-2026:36195: RHSA-2026:36195: 389-ds-base security update (Important)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36206 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)

    * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap     buffer overflow (CVE-2026-11774)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36204 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)

    * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap     buffer overflow (CVE-2026-11774)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36202 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)

    * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap     buffer overflow (CVE-2026-11774)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36201 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)

    * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap     buffer overflow (CVE-2026-11774)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36208 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)

    * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap     buffer overflow (CVE-2026-11774)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36198 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)

    * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap     buffer overflow (CVE-2026-11774)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36197 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)

    * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap     buffer overflow (CVE-2026-11774)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36205 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)

    * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap     buffer overflow (CVE-2026-11774)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a     successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially     crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds     check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled     data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity     Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service     account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable     code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the     CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only. (CVE-2026-11610)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325490	RHEL 8 : 389-ds:1.4 (RHSA-2026:36206)	Nessus	Red Hat Local Security Checks	high
325488	RHEL 8 : redhat-ds:11 (RHSA-2026:36204)	Nessus	Red Hat Local Security Checks	high
325487	RHEL 8 : 389-ds:1.4 (RHSA-2026:36202)	Nessus	Red Hat Local Security Checks	high
325485	RHEL 8 : 389-ds:1.4 (RHSA-2026:36201)	Nessus	Red Hat Local Security Checks	high
325484	RHEL 8 : redhat-ds:11 (RHSA-2026:36208)	Nessus	Red Hat Local Security Checks	high
325483	RHEL 9 : 389-ds-base (RHSA-2026:36198)	Nessus	Red Hat Local Security Checks	high
325481	RHEL 8 : 389-ds:1.4 (RHSA-2026:36197)	Nessus	Red Hat Local Security Checks	high
325479	RHEL 7 : 389-ds-base (RHSA-2026:36205)	Nessus	Red Hat Local Security Checks	high
325407	Linux Distros Unpatched Vulnerability : CVE-2026-11610	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-11610

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

critical