RHSA-2026:64776CriticalCVSS 9.8

Red Hat Security Advisory: 389-ds:1.4 security, bug fix, and enhancement update

Published
September 8, 2026
Last Modified
September 8, 2026

🔗 CVE IDs covered (4)

CVE-2026-18355 →CVE-2026-18453 →CVE-2026-18922 →CVE-2026-76560 →

📋 Description

CVE-2026-18355 — 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() CVE-2026-18453 — 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search CVE-2026-18922 — 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property CVE-2026-76560 — 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN

🎯 Affected products36

  • Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • 389-ds-base-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.ppc64le (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.src (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.src (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • 389-ds-base-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • 389-ds-base-debuginfo-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.ppc64le (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-debuginfo-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-debuginfo-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • 389-ds-base-debugsource-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.ppc64le (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-debugsource-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-debugsource-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • 389-ds-base-devel-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.ppc64le (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-devel-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-devel-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • 389-ds-base-legacy-tools-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.ppc64le (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-legacy-tools-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-legacy-tools-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • 389-ds-base-legacy-tools-debuginfo-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.ppc64le (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-legacy-tools-debuginfo-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-legacy-tools-debuginfo-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • 389-ds-base-libs-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.ppc64le (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-libs-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-libs-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • 389-ds-base-libs-debuginfo-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.ppc64le (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-libs-debuginfo-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-libs-debuginfo-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • 389-ds-base-snmp-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.ppc64le (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • 389-ds-base-snmp-0:1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64 (389-ds:1.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • +6 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Administrators can restrict nsslapd-allowed-sasl-mechanisms to only the mechanisms actually required (e.g. GSSAPI, EXTERNAL, GSS-SPNEGO), excluding PLAIN. Since the exploit chain requires the first bind attempt to be a failed SASL PLAIN bind as cn=Directory Manager, removing PLAIN from the allowed mechanism list prevents that step entirely — this blocks both the originally reported variant (valid low-privileged account) and the zero-credential SASL ANONYMOUS variant, since both depend on the same initial PLAIN bind to plant the stale identity. Workaround: Until a fix is available, review all ACIs using userattr="...#SELFDN" bind rules and confirm the target attribute cannot be set to an empty value, or add an explicit authmethod restriction to the ACI to prevent anonymous binds from satisfying the check. Where anonymous binds are not required, disabling anonymous access to the directory removes the attack surface entirely.

🔗 References (7)