{
  "cveId": "CVE-2026-19404",
  "url": "https://patchblox.com/security/cve/CVE-2026-19404",
  "summary": "CVE-2026-19404 is fixed in 12 products on 1 platform, first by FEDORA-2026-0B8BC362B1, released September 7, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "389-ds-base: - Resolves: rhbz#2492927 CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses siz...",
  "description": "- Resolves: rhbz#2492927 CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [fedora-all]\n- Resolves: rhbz#2497652 CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [fedora-all]\n- Resolves: rhbz#2511796 CVE-2026-69152 389-ds-base: brace-expansion: Denial of Service via unbounded intermediate arrays [fedora-all]\n- Resolves: rhbz#2529450 CVE-2026-76560 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN [fedora-all]\n- Resolves: rhbz#2529451 CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search [fedora-all]\n- Resolves: rhbz#2529452 CVE-2026-18355 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() [fedora-all]\n- Resolves: rhbz#2494775 CVE-2026-11611 389-ds-base: 389-ds-base: Content Sync plugin unbounded queue growth and race conditions [fedora-all]\n- Resolves: rhbz#2494825 CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation [fedora-all]\n- Resolves: rhbz#2494894 CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded iteration count denial of service [fedora-all]\n- Resolves: rhbz#2494895 CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash [fedora-all]\n- Resolves: rhbz#2509729 CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [fedora-all]\n- Resolves: rhbz#2513063 CVE-2026-19404 389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort CleanAllRUV replication maintenance [fedora-all]\n- Resolves: rhbz#2494827 CVE-2026-11793 389-ds-base: 389-ds-base: stack buffer overflow in checkPrefix() algorithm ID parsing [fedora-all]\n- Resolves: rhbz#2494830 CVE-2026-11792 389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_masked_entry_string) [fedora-all]\n- Resolves: rhbz#2498023 CVE-2026-15041 389-ds-base: 389-ds-base: Non-constant-time comparison in PBKDF2-SHA256 password verification [fedora-all]",
  "published": "2026-09-07T21:23:55Z",
  "severity": "critical",
  "epss": 0.00434,
  "epssPercentile": 0.37973,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "389-ds-base",
      "release": "Fedora 43",
      "fixedVersion": "3.1.5-4.fc43",
      "fix": "FEDORA-2026-0B8BC362B1",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-0b8bc362b1",
      "released": "2026-09-07T21:23:55Z"
    },
    {
      "platform": "linux",
      "product": "389-ds-base-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "3.1.5-4.fc43",
      "fix": "FEDORA-2026-0B8BC362B1",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-0b8bc362b1",
      "released": "2026-09-07T21:23:55Z"
    },
    {
      "platform": "linux",
      "product": "389-ds-base-debugsource",
      "release": "Fedora 43",
      "fixedVersion": "3.1.5-4.fc43",
      "fix": "FEDORA-2026-0B8BC362B1",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-0b8bc362b1",
      "released": "2026-09-07T21:23:55Z"
    },
    {
      "platform": "linux",
      "product": "389-ds-base-devel",
      "release": "Fedora 43",
      "fixedVersion": "3.1.5-4.fc43",
      "fix": "FEDORA-2026-0B8BC362B1",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-0b8bc362b1",
      "released": "2026-09-07T21:23:55Z"
    },
    {
      "platform": "linux",
      "product": "389-ds-base-libs",
      "release": "Fedora 43",
      "fixedVersion": "3.1.5-4.fc43",
      "fix": "FEDORA-2026-0B8BC362B1",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-0b8bc362b1",
      "released": "2026-09-07T21:23:55Z"
    },
    {
      "platform": "linux",
      "product": "389-ds-base-libs-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "3.1.5-4.fc43",
      "fix": "FEDORA-2026-0B8BC362B1",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-0b8bc362b1",
      "released": "2026-09-07T21:23:55Z"
    },
    {
      "platform": "linux",
      "product": "389-ds-base-robdb-libs",
      "release": "Fedora 43",
      "fixedVersion": "3.1.5-4.fc43",
      "fix": "FEDORA-2026-0B8BC362B1",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-0b8bc362b1",
      "released": "2026-09-07T21:23:55Z"
    },
    {
      "platform": "linux",
      "product": "389-ds-base-robdb-libs-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "3.1.5-4.fc43",
      "fix": "FEDORA-2026-0B8BC362B1",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-0b8bc362b1",
      "released": "2026-09-07T21:23:55Z"
    },
    {
      "platform": "linux",
      "product": "389-ds-base-snmp",
      "release": "Fedora 43",
      "fixedVersion": "3.1.5-4.fc43",
      "fix": "FEDORA-2026-0B8BC362B1",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-0b8bc362b1",
      "released": "2026-09-07T21:23:55Z"
    },
    {
      "platform": "linux",
      "product": "389-ds-base-snmp-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "3.1.5-4.fc43",
      "fix": "FEDORA-2026-0B8BC362B1",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-0b8bc362b1",
      "released": "2026-09-07T21:23:55Z"
    },
    {
      "platform": "linux",
      "product": "cockpit-389-ds",
      "release": "Fedora 43",
      "fixedVersion": "3.1.5-4.fc43",
      "fix": "FEDORA-2026-0B8BC362B1",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-0b8bc362b1",
      "released": "2026-09-07T21:23:55Z"
    },
    {
      "platform": "linux",
      "product": "python3-lib389",
      "release": "Fedora 43",
      "fixedVersion": "3.1.5-4.fc43",
      "fix": "FEDORA-2026-0B8BC362B1",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-0b8bc362b1",
      "released": "2026-09-07T21:23:55Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T07:50:38Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}