This critical update for Red Hat Directory Server 12.4 E4S addresses multiple vulnerabilities in the 389-ds-base component, including a heap buffer overflow via SASL wrapped-record length underflow (CVE-2026-18355, CVSS 7.5), a pre-authentication NULL pointer dereference (CVE-2026-18453, CVSS 7.5), and a SASL PLAIN authentication flaw allowing privilege escalation to Directory Manager (CVE-2026-18922, CVSS 9.8). The advisory applies to Red Hat Directory Server 12.4 E4S for RHEL 9.4 x86_64. Administrators should apply the update referenced in RHSA-2026:64780 immediately.
Red Hat Product Errata RHSA-2026:64780 - Security Advisory Issued: 2026-09-08 Updated: 2026-09-08 RHSA-2026:64780 - Security Advisory Overview Updated Packages Synopsis Critical: redhat-ds:12 security, bug fix, and enhancement update Type/Severity Security Advisory: Critical Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for the redhat-ds:12 module is now available for Red Hat Directory Server 12.4 E4S for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages for server administration. Security Fix(es): 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355) 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453) 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922) 389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor (CVE-2026-19843) 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560) Bug Fix(es) and Enhancement(s): lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [dirsrv-12.4.z] (JIRA:DIRSRV-869) fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [dirsrv-12.4.z] (JIRA:DIRSRV-901) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Directory Server - 4 years of updates 12 for RHEL 9.4 x86_64 Fixes BZ - 2509186 - CVE-2026-18355 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() BZ - 2509696 - CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search BZ - 2511388 - CVE-2026-18922 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property BZ - 2515965 - CVE-2026-19843 389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor BZ - 2519521 - CVE-2026-76560 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN CVEs CVE-2026-18355 CVE-2026-18453 CVE-2026-18922 CVE-2026-19843 CVE-2026-76560 References https://access.redhat.com/security/updates/classification/#critical Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Directory Server - 4 years of updates 12 for RHEL 9.4 SRPM 389-ds-base-2.4.5-26.module+el9dsrv+24813+95aeb06d.src.rpm SHA-256: b078a0808b5d107d3461fa8992fe668ba2ed89c8a53eb52bdba55472b47b6da3 x86_64 389-ds-base-2.4.5-26.module+el9dsrv+24813+95aeb06d.x86_64.rpm SHA-256: c4423b3676b776c9abae46e849d3c8544f92fe0d9d5cce7db2c9f25c2b96e01c 389-ds-base-debuginfo-2.4.5-26.module+el9dsrv+24813+95aeb06d.x86_64.rpm SHA-256: fb84ba484c40e18fb054d79b90785e2f51fb7e728cdf276238b697aeecba23ff 389-ds-base-debugsource-2.4.5-26.module+el9dsrv+24813+95aeb06d.x86_64.rpm SHA-256: 34fddd5581966b174abf4ecbe69b3f46f7e9527aed0f7f6d9c75dc8d10c6e1a2 389-ds-base-devel-2.4.5-26.module+el9dsrv+24813+95aeb06d.x86_64.rpm SHA-256: f3cbca697e7d639c4b2e36aa205a378396f55f0ef41448a985903873bd6aa720 389-ds-base-libs-2.4.5-26.module+el9dsrv+24813+95aeb06d.x86_64.rpm SHA-256: 862d6f8127c24554a4b8231d174d50aaf5c1971bc69d3f7bf506b43af2043ff2 389-ds-base-libs-debuginfo-2.4.5-26.module+el9dsrv+24813+95aeb06d.x86_64.rpm SHA-256: 242f18938ec91db675c6e18d889bfea4e4510f1607a029387d6e15fe194f6b03 389-ds-base-snmp-2.4.5-26.module+el9dsrv+24813+95aeb06d.x86_64.rpm SHA-256: a5e039be2cccd4bff40983a453879526e144a4d12e0c81524751c66aec043220 389-ds-base-snmp-debuginfo-2.4.5-26.module+el9dsrv+24813+95aeb06d.x86_64.rpm SHA-256: 3546de7ba083383969511f1901978d57343d31ddef680d792e063705733935e4 cockpit-389-ds-2.4.5-26.module+el9dsrv+24813+95aeb06d.noarch.rpm SHA-256: a4ad0fc7ae088f54f3b47b5037141b91c38c376b650e622e0e12381a8553d6c3 python3-lib389-2.4.5-26.module+el9dsrv+24813+95aeb06d.noarch.rpm SHA-256: 3cfb5f42b64b1ab9a7e36be9dca7b2809d7c993eae35473d6982ee18410e23f1 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .