389 Directory Server (Redhat) - vulnerabilities (CVEs)
25 CVEs, 0 in the last 30 days, 324 known versions, newest CVE from 2026-08-03. Vendor: Redhat.
CVEs of 389 Directory Server
- CVE-2026-18651 - CVSS 5.4 (medium), 2026-08-03: A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the…
- CVE-2026-11770 - CVSS 7.5 (high), 2026-07-31: A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check…
- CVE-2026-15722 - CVSS 7.5 (high), 2026-07-31: A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters…
- CVE-2026-15041 - CVSS 3.7 (low), 2026-07-08: A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a…
- CVE-2026-14969 - CVSS 4.4 (medium), 2026-07-07: A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations,…
- CVE-2026-14940 - CVSS 5.3 (medium), 2026-07-07: A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legacy-quoted value…
- CVE-2026-11791 - CVSS 5 (medium), 2026-06-18: A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function unconditionally frees attribute syntax information nodes,…
- CVE-2026-12528 - CVSS 5.4 (medium), 2026-06-17: A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can…
- CVE-2026-11789 - CVSS 6.5 (medium), 2026-06-09: A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a crafted…
- CVE-2026-11793 - CVSS 4.9 (medium), 2026-06-09: A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix() function in pw.c copies an attacker-controlled algorithm ID into a 256-byte…
- CVE-2026-11790 - CVSS 4.9 (medium), 2026-06-09: A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from…
- CVE-2026-11786 - CVSS 6.5 (medium), 2026-06-09: A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during…
- CVE-2026-11785 - CVSS 4.3 (medium), 2026-06-09: A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be…
- CVE-2026-11788 - CVSS 7.5 (high), 2026-06-09: A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an…
- CVE-2026-11787 - CVSS 6.3 (medium), 2026-06-09: A flaw was found in 389 Directory Server. The ldap_utf8prev() function reads bytes before the start of a buffer without bounds checking, causing a heap buffer…
- CVE-2026-11611 - CVSS 6.5 (medium), 2026-06-08: A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client…
- CVE-2026-9064 - CVSS 7.5 (high), 2026-05-20: A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per…
- CVE-2024-6237 - CVSS 6.5 (medium), 2024-07-09: A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended…
- CVE-2024-1062 - CVSS 5.5 (medium), 2024-02-12: A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr.
- CVE-2022-1949 - CVSS 7.5 (high), 2022-06-02: An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed,…
- CVE-2022-0996 - CVSS 6.5 (medium), 2022-03-23: A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication.
- CVE-2021-3514 - CVSS 6.5 (medium), 2021-05-28: When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query, causing a crash.
- CVE-2020-35518 - CVSS 5.3 (medium), 2021-03-26: When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an…
- CVE-2010-2222 - CVSS 7.5 (high), 2019-11-05: The _ger_parse_control function in Red Hat Directory Server 8 and the 389 Directory Server allows attackers to cause a denial of service (NULL pointer…
- CVE-2018-10935 - CVSS 6.5 (medium), 2018-09-11: A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.
