A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in place of the client's own pending operation's response, due to messageID collision. This can cause a client application to treat a failed authentication (bind) attempt as successful.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4932-1 advisory.

    - CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133).
    - CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to     cause a denial of       service or potentially achieve remote code execution (bsc#1279864).
    - CVE-2026-18453: pre-authentication NULL pointer dereference via paged results and       USE_ONE_BACKEND control in op_shared_search (bsc#1279572).
    - CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN     authentication allows       unauthenticated attackers to achieve privilege escalation to Directory Manager (bsc#1279865).
    - CVE-2026-19843: unescaped LDAP DN in Cockpit 389 Console LDAP editor allows an LDAP user with delegated     privileges to       execute shell commands with root privileges on the directory server host (bsc#1279866).
    - CVE-2026-76560: incorrect matching in the SELFDN ACI bind-rule evaluator allows an anonymous LDAP client     to bypass       access controls on directory entries containing empty SELFDN attributes (bsc#1279867).
    - CVE-2026-86344: incomplete LDAP messages sent in rapid succession can cause worker thread exhaustion     (bsc#1284028).
    - CVE-2026-86345: smuggled plaintext commands sent alongside StartTLS requests can cause response forgery     and       authentication bypasses (bsc#1284034).

    Update to version 2.2.11~git12.1e612cde2:

     * Issue 7919 - CVE-2026-86344 - Fix worker pool exhaustion via partial LDAP messages (DoS)
     * Issue 7921 - Fix StartTLS plaintext buffer handling (#7922) (#7947)

    Update to version 2.2.11~git10.1f26fcebd:

     * Issue 7912 - dsidm role create-filtered ignores --nsrolefilter and forces an interactive prompt (#7913)
     * Issue 7908 - dsctl cockpit open-firewall --zone passes a malformed argument (#7909)
     * Issue 7848 - Reject incomplete MD5 and GOST-YESCRYPT hashes (#7849)
     * Issue 7837 - importing ldif with entry with long attribute name and subtype causes stack-buffer-     overflow (#7838)
     * Issue 6270 - heap-use-after-free with pwp dictionary path (#7791)
     * Issue 7611 - PBKDF2 password verification should reject invalid iteration counts (#7632) (#7854)
     * iadvisories/GHSA-rgxx-hcc4-x3h4 / heap-buffer-overflow in rdn_av_swap (#7826)
     * Migrate pwdchan to base64 0.23 Engine API
     * Update rust-dependencies

    Update to version 2.2.11~git1.98ee3aac7:

     * Issue 7757 - stack-buffer-overflow caused by slapi_attr_init_syntax() (#7759)
     * Bump version to 2.2.11
     * Security fix for CVE-2026-76560
     * Security fix for CVE-2026-19843
     * Security fix for CVE-2026-18922
     * Security fix for CVE-2026-18453
     * Security fix for CVE-2026-18355
     * Issue 7595 - Remove the nightly dedup gate and fix dispatched test runs
     * Fix expiration time check (#7718)
     * Issue 7774 - Add backport action (#7775)
     * Issue 7770 - Testimony failure in test_cleanruv_extop_security.py (#7771)
     * Issue 1704 - Include stdbool.h in slapi headers on 2.4 (#7768)
     * CVE-2026-11770 - Fix StartReplicationRequest auth gate response format
     * Security fix for CVE-2026-11770
     * Issue 3082 - Add test389.topologies compatibility shim for backports (#7725)
     * Issue 7595 - Skip redundant CI runs to relieve the Actions queue (#7755)
     * Issue 4701 - Fix UAF when excluding attrs from retro changelog (#7730)
     * Issue 7723 - Range search returns an empty result when its start key is removed (#7724)
     * Issue 7735 - Heap overflow when parsing objectclass superior (#7736)
     * Issue 7733 - Typo about nsuniqueid in tombstone_to_conflict (#7734)
     * Issue 7707 - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in     join_supplier/hub/consumer (#7708)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4929-1 advisory.

    - CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133).
    - CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to     cause a denial of       service or potentially achieve remote code execution (bsc#1279864).
    - CVE-2026-18453: pre-authentication NULL pointer dereference via paged results and       USE_ONE_BACKEND control in op_shared_search (bsc#1279572).
    - CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN     authentication allows       unauthenticated attackers to achieve privilege escalation to Directory Manager (bsc#1279865).
    - CVE-2026-19843: unescaped LDAP DN in Cockpit 389 Console LDAP editor allows an LDAP user with delegated     privileges to       execute shell commands with root privileges on the directory server host (bsc#1279866).
    - CVE-2026-76560: incorrect matching in the SELFDN ACI bind-rule evaluator allows an anonymous LDAP client     to bypass       access controls on directory entries containing empty SELFDN attributes (bsc#1279867).
    - CVE-2026-86344: incomplete LDAP messages sent in rapid succession can cause worker thread exhaustion     (bsc#1284028).
    - CVE-2026-86345: smuggled plaintext commands sent alongside StartTLS requests can cause response forgery     and       authentication bypasses (bsc#1284034).

    Update to version 2.2.11~git12.1e612cde2:

     * Issue 7919 - CVE-2026-86344 - Fix worker pool exhaustion via partial LDAP messages (DoS)
     * Issue 7921 - Fix StartTLS plaintext buffer handling (#7922) (#7947)

    Update to version 2.2.11~git10.1f26fcebd:

     * Issue 7912 - dsidm role create-filtered ignores --nsrolefilter and forces an interactive prompt (#7913)
     * Issue 7908 - dsctl cockpit open-firewall --zone passes a malformed argument (#7909)
     * Issue 7848 - Reject incomplete MD5 and GOST-YESCRYPT hashes (#7849)
     * Issue 7837 - importing ldif with entry with long attribute name and subtype causes stack-buffer-     overflow (#7838)
     * Issue 6270 - heap-use-after-free with pwp dictionary path (#7791)
     * Issue 7611 - PBKDF2 password verification should reject invalid iteration counts (#7632) (#7854)
     * iadvisories/GHSA-rgxx-hcc4-x3h4 / heap-buffer-overflow in rdn_av_swap (#7826)
     * Migrate pwdchan to base64 0.23 Engine API
     * Update rust-dependencies

    Update to version 2.2.11~git1.98ee3aac7:

     * Issue 7757 - stack-buffer-overflow caused by slapi_attr_init_syntax() (#7759)
     * Bump version to 2.2.11
     * Security fix for CVE-2026-76560
     * Security fix for CVE-2026-19843
     * Security fix for CVE-2026-18922
     * Security fix for CVE-2026-18453
     * Security fix for CVE-2026-18355
     * Issue 7595 - Remove the nightly dedup gate and fix dispatched test runs
     * Fix expiration time check (#7718)
     * Issue 7774 - Add backport action (#7775)
     * Issue 7770 - Testimony failure in test_cleanruv_extop_security.py (#7771)
     * Issue 1704 - Include stdbool.h in slapi headers on 2.4 (#7768)
     * CVE-2026-11770 - Fix StartReplicationRequest auth gate response format
     * Security fix for CVE-2026-11770
     * Issue 3082 - Add test389.topologies compatibility shim for backports (#7725)
     * Issue 7595 - Skip redundant CI runs to relieve the Actions queue (#7755)
     * Issue 4701 - Fix UAF when excluding attrs from retro changelog (#7730)
     * Issue 7723 - Range search returns an empty result when its start key is removed (#7724)
     * Issue 7735 - Heap overflow when parsing objectclass superior (#7736)
     * Issue 7733 - Typo about nsuniqueid in tombstone_to_conflict (#7734)
     * Issue 7707 - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in     join_supplier/hub/consumer (#7708)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793296709 advisory.

  - A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a     client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message     that is processed after the TLS upgrade and whose response is delivered to the client in place of the     client's own pending operation's response, due to messageID collision. This can cause a client application     to treat a failed authentication (bind) attempt as successful. (CVE-2026-86345)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793296709 advisory.

  - A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a     client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message     that is processed after the TLS upgrade and whose response is delivered to the client in place of the     client's own pending operation's response, due to messageID collision. This can cause a client application     to treat a failed authentication (bind) attempt as successful. (CVE-2026-86345)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4003 advisory.

    A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation     followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to     hand that connection to a second worker thread before the first worker's result is flushed. The second     worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the     completed operation's result. Repeating this across a small number of connections proportional to the     configured worker-thread pool size exhausts the entire pool under default configuration, denying service     to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the     connections. (CVE-2026-86344)

    A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a     client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message     that is processed after the TLS upgrade and whose response is delivered to the client in place of the     client's own pending operation's response, due to messageID collision. This can cause a client application     to treat a failed authentication (bind) attempt as successful. (CVE-2026-86345)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792597970 advisory.

  - A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation     followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to     hand that connection to a second worker thread before the first worker's result is flushed. The second     worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the     completed operation's result. Repeating this across a small number of connections proportional to the     configured worker-thread pool size exhausts the entire pool under default configuration, denying service     to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the     connections. (CVE-2026-86344)

  - A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a     client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message     that is processed after the TLS upgrade and whose response is delivered to the client in place of the     client's own pending operation's response, due to messageID collision. This can cause a client application     to treat a failed authentication (bind) attempt as successful. (CVE-2026-86345)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a     client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message     that is processed after the TLS upgrade and whose response is delivered to the client in place of the     client's own pending operation's response, due to messageID collision. This can cause a client application     to treat a failed authentication (bind) attempt as successful. (CVE-2026-86345)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
374173	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2026:4932-1)	Nessus	SuSE Local Security Checks	Local	critical
374164	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2026:4929-1)	Nessus	SuSE Local Security Checks	Local	critical
373732	AlmaLinux 9.6 [TuxCare] Security Update: 389-ds-base / 389-ds-base-devel / 389-ds-base-libs / etc (ALMALINUX9.6:CLSA-2026:1793296709)	Nessus	Alma Linux Local Security Checks	Local	critical
373719	Rocky Linux 9.6 [TuxCare] Security Update: 389-ds-base / 389-ds-base-devel / 389-ds-base-libs / etc (ALMALINUX9.6:CLSA-2026:1793296709)	Nessus	Rocky Linux Local Security Checks	Local	critical
371789	Amazon Linux 2 : 389-ds-base (ALAS-2026-4003)	Nessus	Amazon Linux Local Security Checks	Local	critical
369969	AlmaLinux 9.2 [TuxCare] Security Update: 389-ds-base / 389-ds-base-devel / 389-ds-base-libs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792597970)	Nessus	Alma Linux Local Security Checks	Local	critical
362610	Linux Distros Unpatched Vulnerability : CVE-2026-86345	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-86345

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical