A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function unconditionally frees attribute syntax information nodes, bypassing the refcount-based deferred deletion used elsewhere in the attribute syntax subsystem. If an administrator triggers schema reload while concurrent LDAP query traffic is active, worker threads may access freed memory, resulting in use-after-free or double-free and a denial of service (server crash).

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21691-1 advisory.

    Update to version 3.0.6~git382.7a51ea5f5.

    Security issues fixed:

    - CVE-2026-11610: heap buffer overflow in the SASL I/O layer via a crafted oversized LDAP UNBIND packet     (bsc#1270695).
    - CVE-2026-11611: unbounded memory growth allowed by the Content Synchronization persistent search plugin     when an       authenticated client stops reading sync responses (bsc#1267975).
    - CVE-2026-11774: integer overflow in the SASL I/O layer leading to heap buffer overflow via crafted SASL     packet       length prefixes  (bsc#1268298).
    - CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information     disclosure       in LDAP responses to authenticated users (bsc#1268065).
    - CVE-2026-11786: out-of-bounds read in the LDIF parser when processing attribute types with trailing     semicolons       during database import (bsc#1268064).
    - CVE-2026-11787: heap buffer overread due to missing checks in string filter parsing (bsc#1268062).
    - CVE-2026-11788: server crash due to missing allocation failure checks in the dereference control plugin       (bsc#1268057).
    - CVE-2026-11789: integer underflow in the SMD5 password storage plugin leading to a buffer overflow via a     crafted       password hash (bsc#1268058).
    - CVE-2026-11790: excessive CPU consumption during authentication due to improper upper bounds enforcement     in the       PBKDF2-SHA256 password storage plugin (bsc#1268060).
    - CVE-2026-11791: use-after-free in the schema reload mechanism can be triggered while concurrent LDAP     query traffic       is active (bsc#1268047).
    - CVE-2026-11792: heap buffer overflow when audit logging is enabled and short cleartext passwords are     logged       (bsc#1268046).
    - CVE-2026-11793: stack buffer overflow leading to crash via crafted credentials with an oversized     algorithm ID       (bsc#1268041).
    - CVE-2026-11884: heap buffer overflow leading to crash when serializing objectclass definitions     (bsc#1268115).
    - CVE-2026-12528: heap buffer overflow during ACI parsing via malformed ACI strings (bsc#1268491).

    Other updates and bugfixes:

    - Version 3.0.6~git382.7a51ea5f5:
      * Issue 7711 - Fix typo in accountpolicy --login-history-size help text (#7713)
      * Issue 7688 - BUG - partial address leak in sso token (#7689)
      * Issue 7705 - With memberOfEntryScope set, deferred memberOf skips MODIFY operations (#7706)
      * Issue 7698 - Fix silent entry loss in LMDB bulk import waiter handling (#7699)
      * Issue 7666 - Replication performance degradation during total init on high-latency storage (#7667)
      * Issue 7201 - Syscall overhead in LMDB import writer thread (#7204)
      * Issue 7645 - Add runtime LeakSanitizer leak check (#7646)
      * Issue 7714 - UI - sass import rules are deprecated
      * Issue 7658 - Heap Buffer Overflow in sasl_io_recv() via Padded SASL UNBIND
      * Issue 7710 - MemberOf deferred update - Use condvar instead of sleep loop
      * Issue 7637 - UI - Using Arrow Keys in New Object Wizard Resulted in DOM Reload
      * Issue 7578 - schema - attribute refcount is not maintained properly
      * Issue 7605 - Harden CI test ports against ephemeral allocation (#7692)
      * Issue 7528 - Retry the CI image pull instead of failing the job (#7691)
      * Backport Issue 7519 -- ignore obsolete entrydn when entryrdn is in use (#7657)
      * Issue 7460 - MOD_REPLACE on groups/link attributes modifies overlap targets (#7461)
      * Issue 7505 - RFE - CLI - add feature to determine which password policy applies to a user
      * Issue 7670 - BDB range searches intermittently fail with err=1 under write load (#7671)
      * Issue 7108 - Fix shutdown crash in entry cache destruction (#7163)
      * Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7662)
      * Issue 7284 - Automated test for creating local password policy with incorrect passwordInHistory value     (#7608)
      * Issue 7200 - repl-agmt create doesn't set some parameters (#7663)
      * Issue 7573 - Post-import cache autotuning does not recompute entry cache size (#7574)

    - Version 3.0.6~git359.953dc780a:
      * Issue 7470 - dsctl localhost tls import-server-key-cert fails with 'expected str, bytes or os.PathLike     object, not NoneType' (#7477)

    - Version 3.0.6~git356.e6c148b60:
      * Issue 7611 - PBKDF2 password verification should reject invalid iteration count (#7613)
      * Issue 7558 - Total init sends the suffix entry twice (#7640)
      * Issue 7635 - Integer Underflow in {SMD5} Password Comparison (#7636)
      * Issue 7406 - Fix ldap-agent SNMP stats file loading (#7630)
      * Issue 7621 - Stack Buffer Overflow in Password checkPrefix
      * Issue 7623 - Heap Buffer Overflow in 389-ds-base Audit Log Password Masking
      * Issue 7602 - CI - lib389 user compare fails due to parentid mismatch (#7603)
      * Issue 7537 - CI - Fix replication log monitoring parser/timing failures (#7592)
      * Issue 7593 - Fix testimony docstring for SASL overflow test (#7606)
      * Issue 7530 - CI - Stabilize DNA plugin replication tests timing out in CI (#7572)
      * Issue 7593 - Reject invalid SASL packet length values in sasl_io_start_packet (#7594)
      * Issue 3555 - UI - Fix audit issue with npm - ws, js-yaml, babel/core (#7599)
      * Bump fast-uri from 3.1.0 to 3.1.2 in /src/cockpit/389-console (#7487)
      * Update dependency uuid to v14 [SECURITY] (#7456)
      * Update cockpit-389-ds-npm (major) (#7448)
      * Issue 7263 - UI - Use cockpit.file API for temporary file writes (#7590)
      * Issue 7541 - Add invalid ACL text header regression test (#7591)
      * Issue 7554 - UI - Revise local password policy layout
      * Issue 7521 - UI - make changes for cockpit API updates

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3678-1 advisory.

    - CVE-2026-11774: integer overflow in SASL packet length bypasses size limit leading to heap buffer     overflow       (bsc#1268298).
    - CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information     disclosure       (bsc#1268065).
    - CVE-2026-11786: lack of length check can cause an out-of-bound read (bsc#1268064).
    - CVE-2026-11791: schema reload triggered during concurrent LDAP query traffic can lead to a use-after-     free       (bsc#1268047).

    Changes for 389-ds:

    - Update to version 2.7.0~git234.0afa2e38b:
     * Issue 7711 - Fix typo in accountpolicy --login-history-size help text (#7713)
     * Issue 7688 - BUG - partial address leak in sso token (#7689)
     * Issue 7705 - With memberOfEntryScope set, deferred memberOf skips MODIFY operations (#7706)
     * Issue 7714 - UI - sass import rules are deprecated
     * Issue 7658 - Heap Buffer Overflow in sasl_io_recv() via Padded SASL UNBIND
     * Issue 7710 - MemberOf deferred update - Use condvar instead of sleep loop
     * Issue 7637 - fix cherry-pick error
     * Issue 7637 - UI - Using Arrow Keys in New Object Wizard Resulted in DOM Reload
     * Issue 7578 - schema - attribute refcount is not maintained properly
     * Issue 7605 - Harden CI test ports against ephemeral allocation (#7692)
     * Issue 7528 - Retry the CI image pull instead of failing the job (#7691)
     * Issue 7460 - MOD_REPLACE on groups/link attributes modifies overlap targets (#7461)
     * Issue 7670 - BDB range searches intermittently fail with err=1 under write load (#7671)
     * Issue 7108 - Fix shutdown crash in entry cache destruction (#7163)
     * Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7662)
     * Issue 7284 - Automated test for creating local password policy with incorrect passwordInHistory value     (#7608)
     * Issue 7519 - Ignore obsolete entrydn index when entryrdn is enabled (#7526)
     * Issue 7611 - Preserve legacy PBKDF2 hash compatibility (#7649)
     * Issue 7547 - Heap buffer overflow in ldap_utf8prev()
     * Issue 7611 - PBKDF2 password verification should reject invalid iteration count (#7613)
     * Issue 7558 - Total init sends the suffix entry twice (#7640)
     * Issue 7635 - Integer Underflow in {SMD5} Password Comparison (#7636)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3137-1 advisory.

    Update to version 2.2.10~git255.752643c78.

    Security issues fixed:

    - CVE-2026-11610: missing bounds check in `sasl_io_recv()` can lead to a heap buffer overflow when     processing a       specially crafted oversized LDAP UNBIND packet (bsc#1270695).
    - CVE-2026-11611: Content Synchronization persistent search plugin allows unbounded memory growth when an     authenticated       client stops reading sync responses(bsc#1267975).
    - CVE-2026-11774: integer overflow in `sasl_io_start_packet()` can lead to heap buffer overflow when     processing a       crafted SASL packet length prefix (bsc#1268298).
    - CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information     disclosure in       LDA responses (bsc#1268065).
    - CVE-2026-11786: out-of-bounds read in the LDIF parser when processing attribute types with trailing     semicolons during       database import (bsc#1268064).
    - CVE-2026-11787: missing bounds check in the `ldap_utf8prev()` functioncan can lead to a heap buffer     overread in       string filter parsing(bsc#1268062).
    - CVE-2026-11788: missing allocation check in the dereference control plugin  before using a BER structure     can lead to       LDAP server crash when the system is under memory pressure (bsc#1268057).
    - CVE-2026-11789: integer underflow in the SMD5 password storage plugin can lead to a buffer overread when     computing       salt length from a crafted password hash shorter than 16 bytes (bsc#1268058).
    - CVE-2026-11790: improper bounds enforcement in the BKDF2-SHA256 password storage plugin can lead to     excessive       resource consumption during authentication and cause a DoS (bsc#1268060).
    - CVE-2026-11791: use-after-free in the schema reload mechanism can lead to a `ns-slapd` crash when     concurrent LDAP       query traffic is active (bsc#1268047).
    - CVE-2026-11792: missing checks in `create_masked_entry_string` can lead to a heap and log output     corruption whe a       short cleartext password is logged  (bsc#1268046).
    - CVE-2026-11793: missing bounds check in `checkPrefix()` can lead to a stack buffer overflow when     processing an       algorithm ID during parsing of reversible-encrypted attribute values (bsc#1268041).
    - CVE-2026-11884: improper string management can lead to heap buffer overflow when serializing objectclass     definitions       (bsc#1268115).
    - CVE-2026-12528: missing length checks in the `__aclp__normalize_acltxt()` function can lead to heap     buffer overflow       when processing a malformed ACI string (bsc#1268491).

    Other updates and bugfixes:

    - Version 2.2.10~git255.752643c78.
      * Issue 7406 - Fix `ldap-agent` SNMP stats file loading (#7630)
      * Issue 7621 - Stack Buffer Overflow in Password `checkPrefix`
      * Issue 7623 - Heap Buffer Overflow in `389-ds-base` Audit Log Password Masking
      * Issue 6625 - Backport `get_pid` to fix `check_asan_report` (#7625)
      * Issue 7602 - CI - `lib389` user compare fails due to parentid mismatch (#7603)
      * Issue 7537 - CI - Fix replication log monitoring parser/timing failures (#7592)
      * Issue 7593 - Fix testimony docstring for SASL overflow test (#7606)
      * Issue 7530 - CI - Stabilize DNA plugin replication tests timing out in CI (#7572)
      * Issue 7593 - Reject invalid SASL packet length values in `sasl_io_start_packet` (#7594)
      * Issue 3555 - UI - Fix audit issue with `npm` - `ws`, `js-yaml`, `js-yaml` , `postcss`, `uuid`
      * Issue 7541 - Add invalid ACL text header regression test (#7591)
      * Issue 7541 - heap-buffer-overflows in `__aclp__normalize_acltxt()` (#7542)
      * Issue 7576 - Fix leak of temporary attribute syntax hash tables after schema reload
      * Issue 7558 - During online import, the IDL should be created with in-depth first approach (#7559)
      * Issue 7500 - Prevent unsigned integer underflow during stalled import
      * Issue 7560 - `lib389` - Add helper function for checking ASAN files
      * Issue 7539 - Server shutdown during online reindex may lead to data loss (#7540)
      * Issue 7549 - Substring index should validate minimum `nsSubStrBegin`/`nsSubStrEnd` values (#7550)
      * Issue 7440 - Substring index produces empty results and can crash when non-default     `nsSubStrBegin`/`nsSubStrEnd`         lengths are configured (#7441)
      * Fix test389 imports on older branches
      * Issue 7437 - `LeakSanitizer`: memory leaks in CoS cache error paths (#7438)
      * Issue 6922 - `AddressSanitizer`: leaks found by acl test suite
      * Issue 3555 - UI - Fix audit issue with `npm` - `brace-expansion` (#7556)
      * Issue 7554 - deref plugin null pointer dereference if `ber_init` fails
      * Issue 7514 - Crash when doing moddn on very large subtree
      * Issue 7516 - `dblayer_bulk_nextdata` should not return an error when maxrecords is hit

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3136-1 advisory.

    Update to version 2.2.10~git255.752643c78.

    Security issues fixed:

    - CVE-2026-11610: missing bounds check in `sasl_io_recv()` can lead to a heap buffer overflow when     processing a       specially crafted oversized LDAP UNBIND packet (bsc#1270695).
    - CVE-2026-11611: Content Synchronization persistent search plugin allows unbounded memory growth when an     authenticated       client stops reading sync responses(bsc#1267975).
    - CVE-2026-11774: integer overflow in `sasl_io_start_packet()` can lead to heap buffer overflow when     processing a       crafted SASL packet length prefix (bsc#1268298).
    - CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information     disclosure in       LDA responses (bsc#1268065).
    - CVE-2026-11786: out-of-bounds read in the LDIF parser when processing attribute types with trailing     semicolons during       database import (bsc#1268064).
    - CVE-2026-11787: missing bounds check in the `ldap_utf8prev()` functioncan can lead to a heap buffer     overread in       string filter parsing(bsc#1268062).
    - CVE-2026-11788: missing allocation check in the dereference control plugin  before using a BER structure     can lead to       LDAP server crash when the system is under memory pressure (bsc#1268057).
    - CVE-2026-11789: integer underflow in the SMD5 password storage plugin can lead to a buffer overread when     computing       salt length from a crafted password hash shorter than 16 bytes (bsc#1268058).
    - CVE-2026-11790: improper bounds enforcement in the BKDF2-SHA256 password storage plugin can lead to     excessive       resource consumption during authentication and cause a DoS (bsc#1268060).
    - CVE-2026-11791: use-after-free in the schema reload mechanism can lead to a `ns-slapd` crash when     concurrent LDAP       query traffic is active (bsc#1268047).
    - CVE-2026-11792: missing checks in `create_masked_entry_string` can lead to a heap and log output     corruption whe a       short cleartext password is logged  (bsc#1268046).
    - CVE-2026-11793: missing bounds check in `checkPrefix()` can lead to a stack buffer overflow when     processing an       algorithm ID during parsing of reversible-encrypted attribute values (bsc#1268041).
    - CVE-2026-11884: improper string management can lead to heap buffer overflow when serializing objectclass     definitions       (bsc#1268115).
    - CVE-2026-12528: missing length checks in the `__aclp__normalize_acltxt()` function can lead to heap     buffer overflow       when processing a malformed ACI string (bsc#1268491).

    Other updates and bugfixes:

    - Version 2.2.10~git255.752643c78.
      * Issue 7406 - Fix `ldap-agent` SNMP stats file loading (#7630)
      * Issue 7621 - Stack Buffer Overflow in Password `checkPrefix`
      * Issue 7623 - Heap Buffer Overflow in `389-ds-base` Audit Log Password Masking
      * Issue 6625 - Backport `get_pid` to fix `check_asan_report` (#7625)
      * Issue 7602 - CI - `lib389` user compare fails due to parentid mismatch (#7603)
      * Issue 7537 - CI - Fix replication log monitoring parser/timing failures (#7592)
      * Issue 7593 - Fix testimony docstring for SASL overflow test (#7606)
      * Issue 7530 - CI - Stabilize DNA plugin replication tests timing out in CI (#7572)
      * Issue 7593 - Reject invalid SASL packet length values in `sasl_io_start_packet` (#7594)
      * Issue 3555 - UI - Fix audit issue with `npm` - `ws`, `js-yaml`, `js-yaml` , `postcss`, `uuid`
      * Issue 7541 - Add invalid ACL text header regression test (#7591)
      * Issue 7541 - heap-buffer-overflows in `__aclp__normalize_acltxt()` (#7542)
      * Issue 7576 - Fix leak of temporary attribute syntax hash tables after schema reload
      * Issue 7558 - During online import, the IDL should be created with in-depth first approach (#7559)
      * Issue 7500 - Prevent unsigned integer underflow during stalled import
      * Issue 7560 - `lib389` - Add helper function for checking ASAN files
      * Issue 7539 - Server shutdown during online reindex may lead to data loss (#7540)
      * Issue 7549 - Substring index should validate minimum `nsSubStrBegin`/`nsSubStrEnd` values (#7550)
      * Issue 7440 - Substring index produces empty results and can crash when non-default     `nsSubStrBegin`/`nsSubStrEnd`         lengths are configured (#7441)
      * Fix test389 imports on older branches
      * Issue 7437 - `LeakSanitizer`: memory leaks in CoS cache error paths (#7438)
      * Issue 6922 - `AddressSanitizer`: leaks found by acl test suite
      * Issue 3555 - UI - Fix audit issue with `npm` - `brace-expansion` (#7556)
      * Issue 7554 - deref plugin null pointer dereference if `ber_init` fails
      * Issue 7514 - Crash when doing moddn on very large subtree
      * Issue 7516 - `dblayer_bulk_nextdata` should not return an error when maxrecords is hit

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3138-1 advisory.

    This update for 389-ds fixes the following issues

    - Update to version 2.7.0~git212.9b0755edb.
    - CVE-2026-11610: heap buffer overflow in `sasl_io_recv()` via padded SASL UNBIND (bsc#1270695).
    - CVE-2026-11611: content synchronization persistent search plugin can allow unbounded memory growth     (bsc#1267975).
    - CVE-2026-11774: integer overflow in SASL packet length bypasses size limit leading to heap buffer     overflow       (bsc#1268298).
    - CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information     disclosure       (bsc#1268065).
    - CVE-2026-11786: lack of length check can cause an out-of-bounds read (bsc#1268064).
    - CVE-2026-11787: lack of bounds check can lead to a heap buffer overread (bsc#1268062).
    - CVE-2026-11788: lack of allocation failure check can lead to NULL pointer dereference (bsc#1268057).
    - CVE-2026-11789: crafted SMD5 hash can lead to an integer underflow (bsc#1268058).
    - CVE-2026-11790: crafted password hash can cause excessive CPU consumption (bsc#1268060).
    - CVE-2026-11791: schema reload triggered during concurrent LDAP query traffic can lead to a use-after-     free       (bsc#1268047).
    - CVE-2026-11792: password value shorter than 23 characters can cause a heap buffer overflow     (bsc#1268046).
    - CVE-2026-11793: crafted `nsDS5ReplicaCredentials` can lead to a stack buffer overflow (bsc#1268041).
    - CVE-2026-11884: remote code execution and denial of service via heap buffer overflow (bsc#1268115).
    - CVE-2026-12528: heap buffer overflows in `__aclp__normalize_acltxt()` (bsc#1268491).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function     unconditionally frees attribute syntax information nodes, bypassing the refcount-based deferred deletion     used elsewhere in the attribute syntax subsystem. If an administrator triggers schema reload while     concurrent LDAP query traffic is active, worker threads may access freed memory, resulting in use-after-     free or double-free and a denial of service (server crash). (CVE-2026-11791)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
342105	openSUSE 16 Security Update : 389-ds (openSUSE-SU-2026:21691-1)	Nessus	SuSE Local Security Checks	Local	medium
338824	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2026:3678-1)	Nessus	SuSE Local Security Checks	Local	medium
328689	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2026:3137-1)	Nessus	SuSE Local Security Checks	Local	medium
328687	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2026:3136-1)	Nessus	SuSE Local Security Checks	Local	medium
328679	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2026:3138-1)	Nessus	SuSE Local Security Checks	Local	medium
320161	Linux Distros Unpatched Vulnerability : CVE-2026-11791	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-11791

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium