Red Hat Directory Server 12 vulnerabilities

21 CVEs affecting Red Hat Directory Server 12, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-86345, published 2026-10-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-14905, published 2026-02-23. High severity, CVSS 7.2. EPSS: 1.2% chance of exploitation in the next 30 days. A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code…
CVE-2026-18453, published 2026-09-07. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending…
CVE-2026-18355, published 2026-09-07. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an…
CVE-2026-78701, published 2026-08-25. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted…
CVE-2026-11774, published 2026-06-11. High severity, CVSS 7.6. EPSS: 0.7% chance of exploitation in the next 30 days. An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC…
CVE-2025-2487, published 2025-03-18. Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer…
CVE-2025-4574, published 2025-05-13. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.
CVE-2026-18922, published 2026-09-07. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a…
CVE-2026-76560, published 2026-09-07. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an…
CVE-2025-69873, published 2026-02-11. Low severity, CVSS 2.9. EPSS: 0.5% chance of exploitation in the next 30 days. ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON…

Latest

CVE-2026-86345, published 2026-10-02. Critical severity, CVSS 9.0. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP…
CVE-2026-86344, published 2026-10-01. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the…
CVE-2026-19843, published 2026-09-07. High severity, CVSS 8.4. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper…
CVE-2026-18663, published 2026-08-12. Medium severity, CVSS 5.9. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the…
CVE-2026-19404, published 2026-08-10. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker…