CVE-2026-11610: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-11610 is a heap-based buffer overflow vulnerability in the SASL I/O layer of 389 Directory Server (389-ds-base), specifically in the sasl_io_recv() function in sasl_io.c. After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without bounds checking, allowing up to approximately 2 megabytes of attacker-controlled data to overflow the buffer. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and affects all versions through 3.3.0. It was publicly disclosed on July 7, 2026, with patches released the same day. The CVSS v3.1 base score is 8.8 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow): the sasl_io_recv() function in ldap/servers/slapd/sasl_io.c (approximately line 456) performs a memcpy into a fixed 512-byte heap buffer (c_buffer) on the SASL_IO_BUFFER_NOT_ENCRYPTED code path without first validating the incoming data length. The bug was introduced by commit b4cdebbe around 2013. Exploitation requires the attacker to first complete a SASL bind using GSSAPI (Kerberos) or DIGEST-MD5 with integrity protection enabled (SSF > 0), then send a padded raw LDAP UNBIND packet whose payload exceeds 512 bytes. This is distinct from CVE-2025-14905, which patched a separate heap overflow in schema.c. The attack is network-based, requires low privileges, and no user interaction (Github Advisory, Red Hat Bugzilla).

Successful exploitation causes a denial of service via server crash of the 389 Directory Server process, disrupting LDAP authentication and directory services for all dependent systems. In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this condition over the network, making the attack surface very broad. While the primary confirmed impact is availability loss, the CVSS score also reflects high confidentiality and integrity impact ratings, suggesting potential for further exploitation if the overflow can be leveraged beyond a crash (Github Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify 389 Directory Server instances (versions 1.3.2 through 3.3.0) accessible over the network on LDAP port 389 or LDAPS port 636 using network scanning tools such as nmap or ldapsearch.
2. Obtain valid credentials: Acquire a valid domain user account, enrolled host credential, or service account with a valid Kerberos ticket in a FreeIPA or Red Hat Identity Management environment.
3. Perform SASL bind with integrity protection: Initiate an LDAP connection and complete a GSSAPI (Kerberos) or DIGEST-MD5 SASL bind that negotiates a Security Strength Factor (SSF) greater than 0, enabling integrity protection on the session.
4. Craft oversized LDAP UNBIND packet: Construct a raw LDAP UNBIND request padded with attacker-controlled data significantly exceeding 512 bytes (up to ~2 MB).
5. Send malicious packet: Transmit the oversized UNBIND packet over the authenticated SASL session. The server's sasl_io_recv() function copies the data into the 512-byte c_buffer without bounds checking, triggering a heap buffer overflow.
6. Achieve denial of service: The overflow corrupts heap memory, causing the ns-slapd process to crash and the directory service to become unavailable (Red Hat Bugzilla, Github Advisory).

• Network: Unusual or repeated LDAP connections from internal hosts that complete a GSSAPI/DIGEST-MD5 SASL bind followed immediately by an abnormally large UNBIND packet; LDAP traffic with packet sizes significantly exceeding normal UNBIND message sizes (typically a few bytes).
• Logs: Sudden ns-slapd process crash entries in /var/log/dirsrv/slapd-*/errors; core dump files generated in the 389-ds working directory; repeated SASL bind/unbind sequences from the same source IP in LDAP access logs.
• Process: Unexpected termination of the ns-slapd process; systemd or init logs showing 389-ds service restarts (systemctl status dirsrv@*).
• File System: Core dump files (e.g., core.*) in /var/lib/dirsrv/ or the configured core dump directory, generated around the time of the crash.

Red Hat released patches on July 7–8, 2026 across all supported RHEL versions. Key fixed package versions include:

• RHEL 7: 389-ds-base-1.3.11.1-13.el7_9 (RHSA-2026:36205)
• RHEL 8: 389-ds-base via RHSA-2026:36201, RHSA-2026:36197, RHSA-2026:36202, RHSA-2026:36206, and related advisories
• RHEL 9: 389-ds-base-2.8.0-8.el9_8 (RHSA-2026:36195), and related EUS/SAP advisories
• RHEL 10: 389-ds-base-3.2.0-8.el10_2 (RHSA-2026:36196)
• Red Hat Directory Server 11/12: Multiple RHSA advisories issued July 7–8, 2026

As a workaround where patching is not immediately possible, implement network access controls (firewall rules) to restrict LDAP access (ports 389/636) to trusted hosts only, and monitor for anomalous SASL UNBIND activity. Upgrading to a patched package version is the recommended remediation (Red Hat Bugzilla, RHSA-2026:36195, RHSA-2026:36196).

Red Hat issued multiple security advisories (RHSA-2026:36195 through RHSA-2026:36671) on July 7–8, 2026, rating the issue as "Important" severity. The vulnerability was also mentioned in a CISA vulnerability bulletin (SB26-194) published shortly after disclosure. Community discussion appeared on Reddit's r/redhat, and the vulnerability was tracked by multiple security intelligence platforms including VulnDB, Tenable Nessus (multiple plugin IDs), and Qualys. SUSE also issued a security update (SUSE-SU-2026:3136-1) for its 389-ds packages in late July 2026, indicating broad downstream impact across Linux distributions (Red Hat Bugzilla, Github Advisory).