This update for 389-ds fixes the following issues:
- CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133).
- CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of
service or potentially achieve remote code execution (bsc#1279864).
- CVE-2026-18453: pre-authentication NULL pointer dereference via paged results and
USE_ONE_BACKEND control in op_shared_search (bsc#1279572).
- CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication allows
unauthenticated attackers to achieve privilege escal
This update for 389-ds fixes the following issues:
- CVE-2026-11774: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow
(bsc#1268298).
- CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure
(bsc#1268065).
- CVE-2026-11786: lack of length check can cause an out-of-bound read (bsc#1268064).
Changes for 389-ds:
- Update to version 2.2.10~git272.fd28f95da:
* Issue 7688 - BUG - partial address leak in sso token (#7689)
* Issue 7711 - Fix typo in accountpolicy --login-history-size help text (#7713)
* Issue 7645 - Add runtime LeakSanitizer lea
This update for 389-ds fixes the following issues:
Update to version 2.2.10~git255.752643c78.
Security issues fixed:
- CVE-2026-11610: missing bounds check in `sasl_io_recv()` can lead to a heap buffer overflow when processing a
specially crafted oversized LDAP UNBIND packet (bsc#1270695).
- CVE-2026-11611: Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated
client stops reading sync responses(bsc#1267975).
- CVE-2026-11774: integer overflow in `sasl_io_start_packet()` can lead to heap buffer overflow when processing a
crafted SASL packet length prefix (bsc#1268298).
- CVE-2026-11785:
This update for 389-ds fixes the following issue
Update to 2.2.10~git229.1fa7ffdb4:
- CVE-2026-9064: unbounded LDAP controls count in `get_ldapmessage_controls_ext()` can lead to amplified CPU time and
heap allocation and a denial of service (bsc#1265898).
Changelog:
* Issue 7503 - CVE-2026-9064 - Add a limit to the number controls per operation
* Issue 7457 - Refactor memberOf perf test (#7458)
* Issue 7431 - password policy - passwordBadWords is ignored in local policies
* Issue 7417 - UI - global password policy syntax settings missing passwordMaxRepeats
* Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7411)
* I
This update for 389-ds fixes the following issues:
- CVE-2025-14905: Fixed heap buffer overflow due to improper size calculation in `schema_attr_enum_callback` callback (bsc#1258727).