# CVE-2026-11611: 389-ds: This update for 389-ds fixes the following issues: Update to version 2.2.10~git255.752643c78. Security issues fixed... CVE-2026-11611 is fixed in 13 products on 1 platform, first by SUSE-SU-2026:3136-1, released July 20, 2026. It is not reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/cve/CVE-2026-11611 - Priority: Urgent - CVSS: n/a (critical) - EPSS: 0.0024 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jul 20, 2026 ## Description This update for 389-ds fixes the following issues: Update to version 2.2.10~git255.752643c78. Security issues fixed: - CVE-2026-11610: missing bounds check in `sasl_io_recv()` can lead to a heap buffer overflow when processing a specially crafted oversized LDAP UNBIND packet (bsc#1270695). - CVE-2026-11611: Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses(bsc#1267975). - CVE-2026-11774: integer overflow in `sasl_io_start_packet()` can lead to heap buffer overflow when processing a crafted SASL packet length prefix (bsc#1268298). - CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure in LDA responses (bsc#1268065). - CVE-2026-11786: out-of-bounds read in the LDIF parser when processing attribute types with trailing semicolons during database import (bsc#1268064). - CVE-2026-11787: missing bounds check in the `ldap_utf8prev()` functioncan can lead to a heap buffer overread in string filter parsing(bsc#1268062). - CVE-2026-11788: missing allocation check in the dereference control plugin before using a BER structure can lead to LDAP server crash when the system is under memory pressure (bsc#1268057). - CVE-2026-11789: integer underflow in the SMD5 password storage plugin can lead to a buffer overread when computing salt length from a crafted password hash shorter than 16 bytes (bsc#1268058). - CVE-2026-11790: improper bounds enforcement in the BKDF2-SHA256 password storage plugin can lead to excessive resource consumption during authentication and cause a DoS (bsc#1268060). - CVE-2026-11791: use-after-free in the schema reload mechanism can lead to a `ns-slapd` crash when concurrent LDAP query traffic is active (bsc#1268047). - CVE-2026-11792: missing checks in `create_masked_entry_string` can lead to a heap and log output corruption whe a short cleartext password is logged (bsc#1268046). - CVE-2026-11793: missing bounds check in `checkPrefix()` can lead to a stack buffer overflow when processing an algorithm ID during parsing of reversible-encrypted attribute values (bsc#1268041). - CVE-2026-11884: improper string management can lead to heap buffer overflow when serializing objectclass definitions (bsc#1268115). - CVE-2026-12528: missing length checks in the `__aclp__normalize_acltxt()` function can lead to heap buffer overflow when processing a malformed ACI string (bsc#1268491). Other updates and bugfixes: - Version 2.2.10~git255.752643c78. * Issue 7406 - Fix `ldap-agent` SNMP stats file loading (#7630) * Issue 7621 - Stack Buffer Overflow in Password `checkPrefix` * Issue 7623 - Heap Buffer Overflow in `389-ds-base` Audit Log Password Masking * Issue 6625 - Backport `get_pid` to fix `check_asan_report` (#7625) * Issue 7602 - CI - `lib389` user compare fails due to parentid mismatch (#7603) * Issue 7537 - CI - Fix replication log monitoring parser/timing failures (#7592) * Issue 7593 - Fix testimony docstring for SASL overflow test (#7606) * Issue 7530 - CI - Stabilize DNA plugin replication tests timing out in CI (#7572) * Issue 7593 - Reject invalid SASL packet length values in `sasl_io_start_packet` (#7594) * Issue 3555 - UI - Fix audit issue with `npm` - `ws`, `js-yaml`, `js-yaml` , `postcss`, `uuid` * Issue 7541 - Add invalid ACL text header regression test (#7591) * Issue 7541 - heap-buffer-overflows in `__aclp__normalize_acltxt()` (#7542) * Issue 7576 - Fix leak of temporary attribute syntax hash tables after schema reload * Issue 7558 - During online import, the IDL should be created with in-depth first approach (#7559) * Issue 7500 - Prevent unsigned integer underflow during stalled import * Issue 7560 - `lib389` - Add helper function for checking ASAN files * Issue 7539 - Server shutdown during online reindex may lead to data loss (#7540) * Issue 7549 - Substring index should validate minimum `nsSubStrBegin`/`nsSubStrEnd` values (#7550) * Issue 7440 - Substring index produces empty results and can crash when non-default `nsSubStrBegin`/`nsSubStrEnd` lengths are configured (#7441) * Fix test389 imports on older branches * Issue 7437 - `LeakSanitizer`: memory leaks in CoS cache error paths (#7438) * Issue 6922 - `AddressSanitizer`: leaks found by acl test suite * Issue 3555 - UI - Fix audit issue with `npm` - `brace-expansion` (#7556) * Issue 7554 - deref plugin null pointer dereference if `ber_init` fails * Issue 7514 - Crash when doing moddn on very large subtree * Issue 7516 - `dblayer_bulk_nextdata` should not return an error when maxrecords is hit ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | 389-ds opensuse-leap 16.0 | 3.0.6~git382.7a51ea5f5-160000.1.1 | [OPENSUSE-SU-2026:21691-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21691-1.md) | Aug 30, 2026 | | Linux | 389-ds sles 15.6 | 2.2.10~git255.752643c78-150600.8.32.1 | [SUSE-SU-2026:3136-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3136-1.md) | Jul 20, 2026 | | Linux | 389-ds sles 15.7 | 2.7.0~git212.9b0755edb-150700.3.19.1 | [SUSE-SU-2026:3138-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3138-1.md) | Jul 20, 2026 | | Linux | 389-ds sles 16.0 | 3.0.6~git382.7a51ea5f5-160000.1.1 | [SUSE-SU-2026:23574-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23574-1.md) | Aug 30, 2026 | | Linux | 389-ds-base Fedora 43 | 3.1.5-4.fc43 | [FEDORA-2026-0B8BC362B1](https://patchblox.com/security/data/fix/linux/fedora-2026-0b8bc362b1.md) | Sep 7, 2026 | | Linux | 389-ds-base-debuginfo Fedora 43 | 3.1.5-4.fc43 | [FEDORA-2026-0B8BC362B1](https://patchblox.com/security/data/fix/linux/fedora-2026-0b8bc362b1.md) | Sep 7, 2026 | | Linux | 389-ds-base-debugsource Fedora 43 | 3.1.5-4.fc43 | [FEDORA-2026-0B8BC362B1](https://patchblox.com/security/data/fix/linux/fedora-2026-0b8bc362b1.md) | Sep 7, 2026 | | Linux | 389-ds-base-devel Fedora 43 | 3.1.5-4.fc43 | [FEDORA-2026-0B8BC362B1](https://patchblox.com/security/data/fix/linux/fedora-2026-0b8bc362b1.md) | Sep 7, 2026 | | Linux | 389-ds-base-libs Fedora 43 | 3.1.5-4.fc43 | [FEDORA-2026-0B8BC362B1](https://patchblox.com/security/data/fix/linux/fedora-2026-0b8bc362b1.md) | Sep 7, 2026 | | Linux | 389-ds-base-libs-debuginfo Fedora 43 | 3.1.5-4.fc43 | [FEDORA-2026-0B8BC362B1](https://patchblox.com/security/data/fix/linux/fedora-2026-0b8bc362b1.md) | Sep 7, 2026 | | Linux | 389-ds-base-robdb-libs Fedora 43 | 3.1.5-4.fc43 | [FEDORA-2026-0B8BC362B1](https://patchblox.com/security/data/fix/linux/fedora-2026-0b8bc362b1.md) | Sep 7, 2026 | | Linux | 389-ds-base-robdb-libs-debuginfo Fedora 43 | 3.1.5-4.fc43 | [FEDORA-2026-0B8BC362B1](https://patchblox.com/security/data/fix/linux/fedora-2026-0b8bc362b1.md) | Sep 7, 2026 | | Linux | 389-ds-base-snmp Fedora 43 | 3.1.5-4.fc43 | [FEDORA-2026-0B8BC362B1](https://patchblox.com/security/data/fix/linux/fedora-2026-0b8bc362b1.md) | Sep 7, 2026 | | Linux | 389-ds-base-snmp-debuginfo Fedora 43 | 3.1.5-4.fc43 | [FEDORA-2026-0B8BC362B1](https://patchblox.com/security/data/fix/linux/fedora-2026-0b8bc362b1.md) | Sep 7, 2026 | | Linux | cockpit-389-ds Fedora 43 | 3.1.5-4.fc43 | [FEDORA-2026-0B8BC362B1](https://patchblox.com/security/data/fix/linux/fedora-2026-0b8bc362b1.md) | Sep 7, 2026 | | Linux | python3-lib389 Fedora 43 | 3.1.5-4.fc43 | [FEDORA-2026-0B8BC362B1](https://patchblox.com/security/data/fix/linux/fedora-2026-0b8bc362b1.md) | Sep 7, 2026 | --- Data as of 2026-11-10T07:50:38Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.