EUVD-2026-72457

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes...

CVE-2026-18922 389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes...

CVE-2026-18922

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes...

EUVD-2026-72456

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

CVE-2026-18922

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes...

CVE-2026-18453

389 Directory Server (389-ds-base) contains a missing NULL pointer check in the paged results handling of op_shared_search. An unauthenticated remote attacker can exploit this by sending a crafted sequence of search requests using the USE_ONE_BACKEND control , causing the LDAP server to crash and...

CVE-2026-18453

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

CVE-2026-18453

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

CVE-2026-18355

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

EUVD-2026-72455

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

CVE-2026-18355

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

CVE-2026-18355

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

DEBIAN-CVE-2026-76578

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...

CVE-2026-76560 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

CVE-2026-76560

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

CVE-2026-76560 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

EUVD-2026-72400

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

CVE-2026-76560

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...