DEBIAN-CVE-2026-86345

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-86345

Import Source

https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-86345.json

JSON Data

https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-86345

Upstream

CVE-2026-86345

Published

2026-10-02T00:17:04Z

Modified

2026-10-02T09:00:11Z

Severity

9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in place of the client's own pending operation's response, due to messageID collision. This can cause a client application to treat a failed authentication (bind) attempt as successful.

References

https://security-tracker.debian.org/tracker/CVE-2026-86345

Affected packages

Debian:12 / 389-ds-base

Package

Name: 389-ds-base
Purl: pkg:deb/debian/389-ds-base?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.3.1+dfsg1-1

2.3.1+dfsg1-1+deb12u1

2.3.4+dfsg1-1

2.3.4+dfsg1-1.1

2.4.4+dfsg1-1

2.4.4+dfsg1-3

2.4.5+dfsg1-1

3.*

3.0.2+dfsg1-1

3.1.1+dfsg1-1

3.1.1+dfsg1-2

3.1.1+dfsg1-3

3.1.2+dfsg1-1

3.1.2+vendor1-1

3.1.2+vendor1-2

3.3.0-1

3.3.0-2

3.3.1-1

3.3.1-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-86345.json"

Debian:13 / 389-ds-base