ALSA-2026:64784

    Dashboard / Vulnerabilities / ALSA-2026:64784

    ALSA-2026:64784

    Published: 8 Sept 2026Last Modified: 10 Sept 2026

    Summary: Critical: 389-ds-base security, bug fix, and enhancement update

    Details: 389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355) * 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453) * 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922) * 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560) * 389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS (CVE-2026-78701) Bug Fix(es) and Enhancement(s): * lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [almalinux-9.8.z] (JIRA:AlmaLinux-244467) * fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [almalinux-9.8.z] (JIRA:AlmaLinux-248766) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    References: https://access.redhat.com/errata/RHSA-2026:64784, https://access.redhat.com/security/cve/CVE-2026-18355, https://access.redhat.com/security/cve/CVE-2026-18453, https://access.redhat.com/security/cve/CVE-2026-18922, https://access.redhat.com/security/cve/CVE-2026-76560, https://access.redhat.com/security/cve/CVE-2026-78701, https://bugzilla.redhat.com/2509186, https://bugzilla.redhat.com/2509696, https://bugzilla.redhat.com/2511388, https://bugzilla.redhat.com/2519521, https://bugzilla.redhat.com/2523232, https://errata.almalinux.org/9/ALSA-2026-64784.html

    Affected packages

    Package

    Name: 389-ds-base

    Purl: pkg:rpm/almalinux/389-ds-base

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.8.0-10.el9_8

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    ALSA-2026:64784 | CVE-DB