CVE Advisories

Security vulnerabilities discovered during authorized security research

15 CVEs 4 Important 8 Moderate 3 Low
// Important ()

sudo_provider=ldap trusts entire LDAP tree — helpdesk LDAP write to root

sssd · CWE-269

sudo_provider=ldap trusts entire LDAP tree — helpdesk LDAP write to root (Important, CVSS 8.8). Discovered in sssd.

Jul 17, 2026
// Important ()

Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND

389-ds-base · CWE-122

Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (Important, CVSS 8.8). Discovered in 389-ds-base.

Jul 17, 2026
// Important ()

GPO cache path traversal + Kerberos config injection

sssd · CWE-22

GPO cache path traversal + Kerberos config injection (Important, CVSS 8.2). Discovered in sssd.

Jul 17, 2026
// Important ()

Integer overflow in SASL packet length bypasses size limit — RCE on RHEL 8

389-ds-base · CWE-190

Integer overflow in SASL packet length bypasses size limit — RCE on RHEL 8 (Important, CVSS 7.6). Discovered in 389-ds-base.

Jul 2, 2026
// Moderate ()

Content Sync plugin unbounded queue growth and race conditions

389-ds-base · CWE-362

Content Sync plugin unbounded queue growth and race conditions (Moderate, CVSS 6.5). Discovered in 389-ds-base.

Jul 2, 2026
// Moderate ()

Heap buffer overflow in schema objectclass serialization

389-ds-base · CWE-122

Heap buffer overflow in schema objectclass serialization (Moderate, CVSS 6.5). Discovered in 389-ds-base.

Jul 2, 2026
// Moderate ()

NULL pointer dereference in deref control plugin BER parser

389-ds-base · CWE-476

NULL pointer dereference in deref control plugin BER parser (Moderate, CVSS 5.9). Discovered in 389-ds-base.

Jul 2, 2026
// Moderate ()

Use-after-free in schema reload via attr_syntax_swap_ht()

389-ds-base · CWE-416

Use-after-free in schema reload via attr_syntax_swap_ht() (Moderate, CVSS 5.0). Discovered in 389-ds-base.

Jul 2, 2026
// Moderate ()

SMD5 password storage plugin salt length integer underflow crash

389-ds-base · CWE-191

SMD5 password storage plugin salt length integer underflow crash (Moderate, CVSS 4.9). Discovered in 389-ds-base.

Jul 2, 2026
// Moderate ()

PBKDF2 password storage plugin unbounded iteration count DoS

389-ds-base · CWE-400

PBKDF2 password storage plugin unbounded iteration count DoS (Moderate, CVSS 4.9). Discovered in 389-ds-base.

Jul 2, 2026
// Low ()

Stack buffer overflow in checkPrefix() algorithm ID parsing

389-ds-base · CWE-121

Stack buffer overflow in checkPrefix() algorithm ID parsing (Low, CVSS 4.9). Discovered in 389-ds-base.

Jul 2, 2026
// Moderate ()

Partial stack address info leak via ber_printf type confusion

389-ds-base · CWE-843

Partial stack address info leak via ber_printf type confusion (Moderate, CVSS 4.3). Discovered in 389-ds-base.

Jul 2, 2026
// Moderate ()

Heap buffer over-read in ldap_utf8prev() via str2simple filter parsing

389-ds-base · CWE-125

Heap buffer over-read in ldap_utf8prev() via str2simple filter parsing (Moderate, CVSS 3.7). Discovered in 389-ds-base.

Jul 2, 2026
// Low ()

Heap buffer overflow in audit log password masking

389-ds-base · CWE-122

Heap buffer overflow in audit log password masking (Low, CVSS 3.3). Discovered in 389-ds-base.

Jul 2, 2026
// Low ()

Heap out-of-bounds read in LDIF parser str2entry_state_information_from_type

389-ds-base · CWE-125

Heap out-of-bounds read in LDIF parser str2entry_state_information_from_type (Low, CVSS 1.9). Discovered in 389-ds-base.

Jul 2, 2026