Red Hat Directory Server 11 vulnerabilities

14 CVEs affecting Red Hat Directory Server 11, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-86345, published 2026-10-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-78701, published 2026-08-25. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted…
CVE-2025-4574, published 2025-05-13. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.
CVE-2026-76560, published 2026-09-07. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an…
CVE-2025-69873, published 2026-02-11. Low severity, CVSS 2.9. EPSS: 0.5% chance of exploitation in the next 30 days. ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON…
CVE-2025-3416, published 2025-04-08. Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect…
CVE-2026-18663, published 2026-08-12. Medium severity, CVSS 5.9. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the…
CVE-2026-19843, published 2026-09-07. High severity, CVSS 8.4. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper…
CVE-2026-19404, published 2026-08-10. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker…
CVE-2024-8445, published 2024-09-05. Medium severity, CVSS 5.7. EPSS: 0.4% chance of exploitation in the next 30 days. The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying `userPassword` using…
CVE-2026-16560, published 2026-07-22. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the…

Latest

CVE-2026-86345, published 2026-10-02. Critical severity, CVSS 9.0. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP…
CVE-2026-86344, published 2026-10-01. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the…
CVE-2026-11884, published 2026-06-10. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. A heap buffer overflow flaw was found in 389 Directory Server. When serializing objectclass definitions, the oc_superior (SUP) field length is omitted from buffer size calculations in…
CVE-2026-11792, published 2026-06-09. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. A heap buffer overflow flaw was found in 389 Directory Server. When audit logging is enabled, the create_masked_entry_string() function in auditlog.c copies a fixed-length password mask into a…