A critical update for the 389 Directory Server (389-ds) addresses multiple vulnerabilities, including a heap buffer overflow in SASL packet handling (CVE-2026-18355, CVSS 7.5), a pre-authentication NULL pointer dereference (CVE-2026-18453, CVSS 7.5), and a critical SASL PLAIN authentication flaw allowing privilege escalation to Directory Manager (CVE-2026-18922, CVSS 9.8). The update applies to the 389-ds:1.4 module for Red Hat Enterprise Linux 8.4 Advanced Mission Critical and Extended Update Support. Red Hat Product Security has rated this update as Critical, and administrators should apply it immediately following the referenced solution article.
Red Hat Product Errata RHSA-2026:64789 - Security Advisory Issued: 2026-09-08 Updated: 2026-09-08 RHSA-2026:64789 - Security Advisory Overview Updated Packages Synopsis Critical: 389-ds:1.4 security, bug fix, and enhancement update Type/Severity Security Advisory: Critical Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for the 389-ds:1.4 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description 389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355) 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453) 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922) 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560) Bug Fix(es) and Enhancement(s): lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() (JIRA:RHEL-244460) fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation (JIRA:RHEL-248759) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4 x86_64 Red Hat Enterprise Linux Server - AUS 8.4 x86_64 Fixes BZ - 2509186 - CVE-2026-18355 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() BZ - 2509696 - CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search BZ - 2511388 - CVE-2026-18922 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property BZ - 2519521 - CVE-2026-76560 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN CVEs CVE-2026-18355 CVE-2026-18453 CVE-2026-18922 CVE-2026-76560 References https://access.redhat.com/security/updates/classification/#critical Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4 SRPM 389-ds-base-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.src.rpm SHA-256: 8f0e596447bcad60fedddce53cc04e5cd8d4e05cee86e1b855e5266888870953 x86_64 389-ds-base-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: 2c637d03bfa0e9cf2c8cd173c49318860ed89ba4fb210cf4bf6911a1e7ede616 389-ds-base-debuginfo-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: 7de570b6f1ba5641b0cfcceca6ccaf82659d91e8f4d93015c6656abf4c685008 389-ds-base-debugsource-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: 5c880d969d9964e002a504418b4140c0ff150b7adc1ae7542fb5596f6820def1 389-ds-base-devel-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: b0a0cbdb4f7c91d6e2f3e22f8c6efc1c6602830838ed01e3638e119b42f6cb28 389-ds-base-legacy-tools-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: ac7bc58b28110b06688ec64773e4fcddbe93f4df42b7c50fbabbde1db1a668ff 389-ds-base-legacy-tools-debuginfo-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: 20320cc62cad7a307655c7ce92647447964b6e8f972bc8ee8b8ac1176c3138b5 389-ds-base-libs-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: 5585080a03a2ac6587b94893759ac2503362665dd03072d9d79d59ca4a1b3a05 389-ds-base-libs-debuginfo-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: a917b29dbc03375cbe2d87a9f7fe2e14dfdd0706ab1d8151a0f25ef88517e7cb 389-ds-base-snmp-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: 7b921bdcf95cdc29d6512385210d403cda670e3eb0ca9b3e0a946e62feaa540c 389-ds-base-snmp-debuginfo-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: 399d39b030c1da9f78ab96efb9b12a5bd715746a0376e1d75cd84647989a4a77 python3-lib389-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.noarch.rpm SHA-256: b1de3720e1d5ab7ee302c061de71028deb17cc0e0c188ecb765a8f2a9fac7688 Red Hat Enterprise Linux Server - AUS 8.4 SRPM 389-ds-base-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.src.rpm SHA-256: 8f0e596447bcad60fedddce53cc04e5cd8d4e05cee86e1b855e5266888870953 x86_64 389-ds-base-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: 2c637d03bfa0e9cf2c8cd173c49318860ed89ba4fb210cf4bf6911a1e7ede616 389-ds-base-debuginfo-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: 7de570b6f1ba5641b0cfcceca6ccaf82659d91e8f4d93015c6656abf4c685008 389-ds-base-debugsource-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: 5c880d969d9964e002a504418b4140c0ff150b7adc1ae7542fb5596f6820def1 389-ds-base-devel-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: b0a0cbdb4f7c91d6e2f3e22f8c6efc1c6602830838ed01e3638e119b42f6cb28 389-ds-base-legacy-tools-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: ac7bc58b28110b06688ec64773e4fcddbe93f4df42b7c50fbabbde1db1a668ff 389-ds-base-legacy-tools-debuginfo-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: 20320cc62cad7a307655c7ce92647447964b6e8f972bc8ee8b8ac1176c3138b5 389-ds-base-libs-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: 5585080a03a2ac6587b94893759ac2503362665dd03072d9d79d59ca4a1b3a05 389-ds-base-libs-debuginfo-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: a917b29dbc03375cbe2d87a9f7fe2e14dfdd0706ab1d8151a0f25ef88517e7cb 389-ds-base-snmp-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: 7b921bdcf95cdc29d6512385210d403cda670e3eb0ca9b3e0a946e62feaa540c 389-ds-base-snmp-debuginfo-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64.rpm SHA-256: 399d39b030c1da9f78ab96efb9b12a5bd715746a0376e1d75cd84647989a4a77 python3-lib389-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.noarch.rpm SHA-256: b1de3720e1d5ab7ee302c061de71028deb17cc0e0c188ecb765a8f2a9fac7688 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .