CVE-2026-11774

Name of the Vulnerable Software and Affected Versions 389 Directory Server (389-ds-base) (affected versions not specified)

Description An integer overflow exists in the SASL I/O layer within the sasl io start packet() function. When a crafted SASL packet length prefix of 0xFFFFFFFC is processed, adding sizeof(uint32 t) causes an unsigned wraparound to zero. This action bypasses the nsslapd-maxsasliosize limit, resulting in a heap buffer overflow of approximately 2 megabytes of attacker-controlled data. Following a successful SASL bind with integrity protection (SSF > 0), a remote attacker can trigger a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, this can be executed over the network by any domain user with a valid Kerberos ticket, enrolled host, or service account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.