Security update for 389-ds
This update for 389-ds fixes the following issues: Update to version 3.0.6~git382.7a51ea5f5. Security issues fixed: - CVE-2026-11610: heap buffer overflow in the SASL I/O layer via a crafted oversized LDAP UNBIND packet (bsc#1270695). - CVE-2026-11611: unbounded memory growth allowed by the Content Synchronization persistent search plugin when an authenticated client stops reading sync responses (bsc#1267975). - CVE-2026-11774: integer overflow in the SASL I/O layer leading to heap buffer overflow via crafted SASL packet length prefixes (bsc#1268298). - CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure in LDAP responses to authenticated users (bsc#1268065). - CVE-2026-11786: out-of-bounds read in the LDIF parser when processing attribute types with trailing semicolons during database import (bsc#1268064). - CVE-2026-11787: heap buffer overread due to missing checks in string filter parsing (bsc#1268062). - CVE-2026-11788: server crash due to missing allocation failure checks in the dereference control plugin (bsc#1268057). - CVE-2026-11789: integer underflow in the SMD5 password storage plugin leading to a buffer overflow via a crafted password hash (bsc#1268058). - CVE-2026-11790: excessive CPU consumption during authentication due to improper upper bounds enforcement in the PBKDF2-SHA256 password storage plugin (bsc#1268060). - CVE-2026-11791: use-after-free in the schema reload mechanism can be triggered while co
SUSE-SU-2026:23574-1
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:SUSE-SU-2026:23574-1
389-ds
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.0.6~git382.7a51ea5f5-160000.1.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
389-ds
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.0.6~git382.7a51ea5f5-160000.1.1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.6~git382.7a51ea5f5-160000.1.1"
}
]
}
],
"package": {
"name": "389-ds",
"purl": "pkg:rpm/suse/389-ds&distro=SUSE%20Linux%20Enterprise%20Server%2016.0",
"ecosystem": "SUSE:Linux Enterprise Server 16.0"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23574-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"389-ds": "3.0.6~git382.7a51ea5f5-160000.1.1",
"lib389": "3.0.6~git382.7a51ea5f5-160000.1.1",
"389-ds-snmp": "3.0.6~git382.7a51ea5f5-160000.1.1",
"libsvrcore0": "3.0.6~git382.7a51ea5f5-160000.1.1",
"389-ds-devel": "3.0.6~git382.7a51ea5f5-160000.1.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.6~git382.7a51ea5f5-160000.1.1"
}
]
}
],
"package": {
"name": "389-ds",
"purl": "pkg:rpm/suse/389-ds&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0",
"ecosystem": "SUSE:Linux Enterprise Server for SAP applications 16.0"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23574-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"389-ds": "3.0.6~git382.7a51ea5f5-160000.1.1",
"lib389": "3.0.6~git382.7a51ea5f5-160000.1.1",
"389-ds-snmp": "3.0.6~git382.7a51ea5f5-160000.1.1",
"libsvrcore0": "3.0.6~git382.7a51ea5f5-160000.1.1",
"389-ds-devel": "3.0.6~git382.7a51ea5f5-160000.1.1"
}
]
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #30779 · Revision 1
- Added to Heist Feed
- Publisher date