A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server

CVE-2026-18355 is an integer underflow in sasl_io_start_packet() within 389 Directory Server (389-ds-base). When a SASL-bound client sends a wrapped-record length of 0, 1, or 2 bytes, encrypted_buffer_count falls below the already-consumed encrypted_buffer_offset, producing an unsigned subtraction that wraps to ~4 GiB. The subsequent PR_Recv() call then tries to shove network-controlled data into a 1024-byte heap buffer, giving the attacker a massive heap overflow. The bug requires a completed SASL bind with integrity protection (SSF > 0), meaning the attacker must hold valid LDAP credentials. Affected versions span 389-ds-base shipped in RHEL 9 (≤ 2.8.0-8), RHEL 10 (≤ 3.0.6-20), and Red Hat Directory Server 11 for RHEL 8. This is distinct from CVE-2026-11774, whose fix only addressed the *upper*-bound overflow path — the lower-bound underflow was left unpatched until now.

Red Hat rates this Important / 7.5 HIGH, which is fair. The CVSS vector correctly encodes the authentication prerequisite (PR:L) and high attack complexity (AC:H) stemming from the need for a successful SASL integrity-layer bind before the trigger. However, the vector's Scope:Unchanged understates the real blast radius in identity-tier deployments: 389-ds-base is the backend for FreeIPA / Red Hat IdM, meaning a successful RCE on this process owns the enterprise identity store. Red Hat explicitly states *no practical mitigation exists* — you must patch. Given that the attack is post-auth, requires a specific SASL negotiation path, and no public PoC exists, the vendor's HIGH is appropriate: high enough to reflect the identity-tier consequence, not CRITICAL because of real friction in weaponization.

Why this verdict

• Authentication gate (PR:L): The attacker must hold valid LDAP credentials and complete a SASL integrity-layer bind before reaching the vulnerable code. This eliminates opportunistic scanning and limits the attacker population to insiders or post-compromise actors. Neutral — does not lower from vendor baseline because LDAP credentials are widely held in enterprise environments.
• Attack complexity (AC:H): The SASL security layer must be negotiated, and reliable RCE requires heap grooming past ASLR. This is correctly modeled in the vendor vector and keeps the score at 7.5 rather than 8.8 (which would result from AC:L). No adjustment.
• No PoC, no exploitation: Zero public exploit code and no KEV listing reduce urgency relative to actively exploited vulns but do not change the inherent severity. No adjustment.
• Role multiplier: 389-ds-base is canonically an identity-tier component — ≥90% of installations serve as the LDAP backend for FreeIPA/IdM or Red Hat Directory Server. Successful exploitation (even DoS-only) on a FreeIPA replica disrupts Kerberos authentication, sudo policy, HBAC, and certificate issuance for the entire IPA domain. RCE grants read/write access to all user credentials, Kerberos keys, and group memberships — equivalent to domain compromise. This floors the verdict at HIGH regardless of friction.
• No vendor mitigation available: Red Hat explicitly states no practical compensating control exists. The only remediation is patching. This increases operational urgency within the HIGH bracket but does not change the severity score itself.

Why not higher?

CRITICAL would require either active exploitation (KEV/ITW) or a lower friction path (unauthenticated, low complexity). This CVE requires valid credentials *and* a specific SASL negotiation path (AC:H), and there is no public PoC or evidence of weaponization. The theoretical RCE via heap overflow is undemonstrated past ASLR on RHEL 9/10. While the identity-tier role is severe, the compounding authentication and complexity prerequisites keep this firmly in HIGH, not CRITICAL.

Why not lower?

Downgrading to MEDIUM would require either a narrow installed base or limited blast radius — neither applies. 389-ds-base is the *defining* component of FreeIPA/IdM identity infrastructure, placing ≥90% of installations in the high-value identity-provider role. Even the DoS-only outcome (which is trivially achievable once authenticated) causes domain-wide authentication outage. Red Hat confirms no mitigation exists, meaning unpatched instances have zero compensating controls. The identity-tier floor holds at HIGH.

1. Restrict LDAP network access to known management and replica IPs — Use iptables/nftables or firewall zones to limit who can reach ports 389/636 on the directory server. This reduces the pool of hosts that can attempt the SASL bind. Deploy within the noisgate mitigation SLA of 30 days for HIGH severity.
2. Audit and reduce LDAP service accounts with SASL bind capability — Review accounts that bind via GSSAPI or other SASL mechanisms. Disable or rotate credentials for unused service accounts to shrink the attack surface. Complete within the 30-day mitigation window.
3. Monitor ns-slapd process health and auto-restart — Configure systemd watchdog or a process monitor (e.g., Monit) to detect and restart ns-slapd crashes immediately. This limits DoS dwell time but does not prevent RCE. Implement immediately as a resilience measure.
4. Deploy FreeIPA replicas across failure domains — Ensure at least 2-3 FreeIPA replicas exist so that a DoS crash on one instance does not cause domain-wide authentication failure. This is standard IdM architecture but worth verifying now.

Run this script on each 389-ds-base host as root (or any user that can query RPM). Usage: sudo bash check_cve_2026_18355.sh. No network access required — it checks the installed package version against known-fixed versions.

#!/bin/bash
# check_cve_2026_18355.sh — Detect CVE-2026-18355 in 389-ds-base
# Run on target RHEL host. Requires: rpm. No special privileges needed.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

PKG="389-ds-base"

# Check if 389-ds-base is installed
if ! rpm -q "$PKG" &>/dev/null; then
  echo "UNKNOWN — $PKG is not installed on this host."
  exit 2
fi

INSTALLED=$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' "$PKG" | head -1)
echo "Installed: $PKG-$INSTALLED"

# Extract major.minor.patch and release number
VER=$(echo "$INSTALLED" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')
REL=$(echo "$INSTALLED" | grep -oP '(?<=-)[0-9]+' | head -1)

MAJOR=$(echo "$VER" | cut -d. -f1)
MINOR=$(echo "$VER" | cut -d. -f2)
PATCH=$(echo "$VER" | cut -d. -f3)

# Fixed versions:
#   RHEL 9.8:   2.8.0-10.el9_8
#   RHEL 10.0:  3.0.6-21.el10_0
#   RHEL 9.6 EUS: 2.6.1-24.el9_6

vulnerable=0

if [[ "$MAJOR" -eq 3 ]]; then
  # RHEL 10 stream: fixed in 3.0.6-21
  if [[ "$MINOR" -eq 0 && "$PATCH" -le 6 && "$REL" -lt 21 ]]; then
    vulnerable=1
  elif [[ "$MINOR" -eq 0 && "$PATCH" -lt 6 ]]; then
    vulnerable=1
  fi
elif [[ "$MAJOR" -eq 2 && "$MINOR" -eq 8 ]]; then
  # RHEL 9.8 stream: fixed in 2.8.0-10
  if [[ "$PATCH" -eq 0 && "$REL" -lt 10 ]]; then
    vulnerable=1
  fi
elif [[ "$MAJOR" -eq 2 && "$MINOR" -eq 6 ]]; then
  # RHEL 9.6 EUS stream: fixed in 2.6.1-24
  if [[ "$PATCH" -le 1 && "$REL" -lt 24 ]]; then
    vulnerable=1
  fi
elif [[ "$MAJOR" -eq 2 && "$MINOR" -lt 6 ]]; then
  # Older 2.x — likely vulnerable, no backport confirmed
  vulnerable=1
elif [[ "$MAJOR" -lt 2 ]]; then
  vulnerable=1
fi

if [[ "$vulnerable" -eq 1 ]]; then
  echo "VULNERABLE — $PKG-$INSTALLED is affected by CVE-2026-18355."
  echo "Update to the fixed version for your RHEL stream."
  exit 1
else
  echo "PATCHED — $PKG-$INSTALLED includes the fix for CVE-2026-18355."
  exit 0
fi

Sources

1. Red Hat CVE Page — CVE-2026-18355
2. OffSeq Threat Radar — CVE-2026-18355
3. Shenlong CVE Platform — SASL heap overflow intel
4. THREATINT — CVE-2026-18355
5. Red Hat Errata RHSA-2026:36195 (earlier SASL fixes)
6. Red Hat Bugzilla — CVE-2026-11774 (related upper-bound fix)
7. 389ds/389-ds-base GitHub Security Advisories