Red Hat Directory Server 13 vulnerabilities

16 CVEs affecting Red Hat Directory Server 13, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-86345, published 2026-10-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-14905, published 2026-02-23. High severity, CVSS 7.2. EPSS: 1.2% chance of exploitation in the next 30 days. A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code…
CVE-2026-18453, published 2026-09-07. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending…
CVE-2026-18355, published 2026-09-07. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an…
CVE-2026-78701, published 2026-08-25. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted…
CVE-2026-11774, published 2026-06-11. High severity, CVSS 7.6. EPSS: 0.7% chance of exploitation in the next 30 days. An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC…
CVE-2026-18922, published 2026-09-07. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a…
CVE-2026-76560, published 2026-09-07. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an…
CVE-2025-69873, published 2026-02-11. Low severity, CVSS 2.9. EPSS: 0.5% chance of exploitation in the next 30 days. ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON…
CVE-2026-18663, published 2026-08-12. Medium severity, CVSS 5.9. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the…
CVE-2026-11610, published 2026-07-07. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send…

Latest

CVE-2026-86345, published 2026-10-02. Critical severity, CVSS 9.0. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP…
CVE-2026-86344, published 2026-10-01. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the…
CVE-2026-19404, published 2026-08-10. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker…
CVE-2026-16560, published 2026-07-22. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the…