Fedora Account System
Red Hat Associate
Red Hat Customer
A flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the 4-byte wrapped-record length read from the wire is validated only against an upper bound (the check added for CVE-2026-11774). When a SASL-authenticated attacker sends a wrapped record with a wire length of 0 (or 1 or 2), the resulting encrypted_buffer_count (4, 5, or 6 after adding sizeof(uint32_t)) is less than encrypted_buffer_offset (7, the header bytes already consumed). The unsigned subtraction in sasl_io_read_packet() then underflows to approximately 0xFFFFFFFD, and PR_Recv is requested to read roughly 4 GiB into the 1024-byte encrypted_buffer allocated in sasl_io_init_buffers(). This causes a heap buffer overflow with attacker-controlled length and content. The vulnerability requires authentication via a SASL bind with integrity protection (SSF > 0). This is a distinct defect from CVE-2026-11774, which only guards against lengths near UINT32_MAX; the lower-end case is not covered and the vulnerability persists at HEAD.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:64771 https://access.redhat.com/errata/RHSA-2026:64771
This issue has been addressed in the following products: Red Hat Directory Server 12.2 E4S for RHEL 9 Via RHSA-2026:64779 https://access.redhat.com/errata/RHSA-2026:64779
This issue has been addressed in the following products: Red Hat Directory Server 12.4 E4S for RHEL 9 Via RHSA-2026:64780 https://access.redhat.com/errata/RHSA-2026:64780
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:64776 https://access.redhat.com/errata/RHSA-2026:64776
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:64778 https://access.redhat.com/errata/RHSA-2026:64778
This issue has been addressed in the following products: Red Hat Directory Server 11.7 E4S for RHEL 8 Via RHSA-2026:64792 https://access.redhat.com/errata/RHSA-2026:64792
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:64781 https://access.redhat.com/errata/RHSA-2026:64781
This issue has been addressed in the following products: Red Hat Directory Server 11.9 for RHEL 8 Via RHSA-2026:64793 https://access.redhat.com/errata/RHSA-2026:64793
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:64789 https://access.redhat.com/errata/RHSA-2026:64789
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:64790 https://access.redhat.com/errata/RHSA-2026:64790
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:64783 https://access.redhat.com/errata/RHSA-2026:64783
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:64804 https://access.redhat.com/errata/RHSA-2026:64804
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:64791 https://access.redhat.com/errata/RHSA-2026:64791
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:64785 https://access.redhat.com/errata/RHSA-2026:64785
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:64784 https://access.redhat.com/errata/RHSA-2026:64784
This issue has been addressed in the following products: Red Hat Directory Server 11.5 E4S for RHEL 8 Via RHSA-2026:79217 https://access.redhat.com/errata/RHSA-2026:79217