{"id":13071,"date":"2026-09-04T18:59:51","date_gmt":"2026-09-04T10:59:51","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-11610"},"modified":"2026-09-04T18:59:51","modified_gmt":"2026-09-04T10:59:51","slug":"cve-2026-11610","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-11610","title":{"rendered":"CVE-2026-11610 [HIGH] &#8211; A heap buffer overflow flaw was found in the SASL I\/O layer of 389 Directory Server\n(389-d"},"content":{"rendered":"<p>A heap buffer overflow flaw was found in the SASL I\/O layer of 389 Directory Server<br \/>\n(389-ds-base). After a successful SASL bind with integrity protection (SSF &gt; 0),<br \/>\nan authenticated attacker can send a specially crafted oversized LDAP UNBIND packet<br \/>\nthat is copied into a 512-byte heap receive buffer without a bounds check in<br \/>\nsasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of<br \/>\nattacker-controlled data to overflow the buffer, causing a denial of service (server<br \/>\ncrash). In FreeIPA and Red Hat Identity Management deployments, any domain user with<br \/>\na valid Kerberos ticket, any enrolled host, or any service account can trigger this<br \/>\nvulnerability over the network after authenticating via GSSAPI.<br \/>\nThe vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and<br \/>\nwas not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow<br \/>\nin schema.c only.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A heap buffer overflow flaw was found in the SASL I\/O layer of 389 Directory Server<br \/>\n(389-ds-base). After a successful SASL bind with integrity protection (SSF &gt; 0),<br \/>\nan authenticated attacker can send <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-13071","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/13071","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=13071"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=13071"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=13071"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}