Red Hat Directory Server vulnerabilities

42 CVEs affecting Red Hat Directory Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-18651, published 2026-08-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2008-0892, published 2008-04-16. High severity, CVSS 9.0. EPSS: 14% chance of exploitation in the next 30 days. The replication monitor CGI script (repl-monitor-cgi.pl) in Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and EL5, allows remote attackers to execute arbitrary commands.
CVE-2008-2928, published 2008-08-29. High severity, CVSS 10.0. EPSS: 6.6% chance of exploitation in the next 30 days. Multiple buffer overflows in the adminutil library in CGI applications in Red Hat Directory Server 7.1 before SP7 allow remote attackers to cause a denial of service (daemon crash) or possibly…
CVE-2008-2930, published 2008-08-29. High severity, CVSS 7.1. EPSS: 6.6% chance of exploitation in the next 30 days. Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 allow remote attackers to cause a denial of service (CPU consumption and search outage) via…
CVE-2008-1677, published 2008-05-12. High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days. Buffer overflow in the regular expression handler in Red Hat Directory Server 8.0 and 7.1 before SP6 allows remote attackers to cause a denial of service (slapd crash) and possibly execute arbitrary…
CVE-2008-3283, published 2008-08-29. High severity, CVSS 7.8. EPSS: 2.9% chance of exploitation in the next 30 days. Multiple memory leaks in Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 and earlier allow remote attackers to cause a denial of service (memory…
CVE-2014-3562, published 2014-08-21. Medium severity, CVSS 5.0. EPSS: 2.2% chance of exploitation in the next 30 days. Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory.
CVE-2008-0893, published 2008-04-16. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and EL5, does not properly restrict access to CGI scripts, which allows remote attackers to perform administrative actions.
CVE-2013-4485, published 2013-11-23. Medium severity, CVSS 4.0. EPSS: 2% chance of exploitation in the next 30 days. 389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote authenticated users to cause a denial of service (crash) via multiple @ characters in a GER attribute list…
CVE-2013-2219, published 2013-07-31. Medium severity, CVSS 4.0. EPSS: 1.8% chance of exploitation in the next 30 days. The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information…
CVE-2008-2929, published 2008-08-29. Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway (DSGW) web interface in Red Hat Directory…

Latest

CVE-2026-18651, published 2026-08-03. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is…
CVE-2026-15722, published 2026-07-31. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into…
CVE-2026-11770, published 2026-07-31. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler…
CVE-2026-15041, published 2026-07-08. Low severity, CVSS 3.7. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A…
CVE-2026-14969, published 2026-07-07. Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged…
CVE-2026-14940, published 2026-07-07. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legacy-quoted value encoding a multivalued nested Relative…
CVE-2026-11791, published 2026-06-18. Medium severity, CVSS 5.0. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function unconditionally frees attribute syntax information nodes, bypassing the refcount-based deferred…
CVE-2026-12528, published 2026-06-17. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and…
CVE-2026-11790, published 2026-06-09. Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker…
CVE-2026-11789, published 2026-06-09. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a crafted password hash shorter than 16 bytes, causing a…