{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-11610 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-11610 is a high-severity memory corruption vulnerability in 389ds 389-ds-base, published on 7 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-11610 and fix it if it is affected.\n\nWhat it is: CVE-2026-11610 is a high-severity memory corruption vulnerability in 389ds 389-ds-base, published on 7 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-11610 in the wild and no public exploit code.\n\nAffected product: 389ds 389-ds-base. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-11610/ (Markdown: https://insights.sbomify.com/CVE-2026-11610/index.md)","id":"CVE-2026-11610","markdown":"https://insights.sbomify.com/CVE-2026-11610/index.md","name":"CVE-2026-11610","record":{"aliases":["AZL-92069","CLSA-2026-1784796076","DEBIAN-CVE-2026-11610","GHSA-2g8g-f92j-g4gq","UBUNTU-CVE-2026-11610"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"LDAP directory server","requires_auth":"low_privilege","summary":"An authenticated attacker can cause a denial of service in 389 Directory Server by sending a crafted oversized LDAP UNBIND packet that triggers a heap buffer overflow.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-122","name":"Heap-based Buffer Overflow"}],"description":"A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server\n(389-ds-base). After a successful SASL bind with integrity protection (SSF \u003e 0),\nan authenticated attacker can send a specially crafted oversized LDAP UNBIND packet\nthat is copied into a 512-byte heap receive buffer without a bounds check in\nsasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of\nattacker-controlled data to overflow the buffer, causing a denial of service (server\ncrash). In FreeIPA and Red Hat Identity Management deployments, any domain user with\na valid Kerberos ticket, any enrolled host, or any service account can trigger this\nvulnerability over the network after authenticating via GSSAPI.\nThe vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and\nwas not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow\nin schema.c only.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind","id":"CVE-2026-11610","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":19,"next":{"headline":"389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions","id":"CVE-2026-11611"},"packages":[],"prev":{"headline":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","id":"CVE-2026-11609"},"products":["389-ds-base","Red Hat Directory Server 11.5 E4S for RHEL 8","Red Hat Directory Server 11.7 E4S for RHEL 8","Red Hat Directory Server 11.9 for RHEL 8","Red Hat Directory Server 12","Red Hat Directory Server 12.2 E4S for RHEL 9","Red Hat Directory Server 12.4 E4S for RHEL 9","Red Hat Directory Server 13","Red Hat Directory Server 13.2","Red Hat Enterprise Linux 10","Red Hat Enterprise Linux 10.0 Extended Update Support","Red Hat Enterprise Linux 6","Red Hat Enterprise Linux 7 Extended Lifecycle Support","Red Hat Enterprise Linux 8","Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","Red Hat Enterprise Linux 8.8 Telecommunications Update Service","Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","Red Hat Enterprise Linux 9","Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","Red Hat Enterprise Linux 9.6 Extended Update Support"],"published":"2026-07-07","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-07-08","vendors":["389ds","Red Hat"]},"summary":"An authenticated attacker can cause a denial of service in 389 Directory Server by sending a crafted oversized LDAP UNBIND packet that triggers a heap buffer overflow.","url":"https://insights.sbomify.com/CVE-2026-11610/"}