SUSE-SU-2026:3138-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-20263138-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3138-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:3138-1
Upstream
CVE (14)
  • CVE-2026-11610
  • CVE-2026-11611
  • CVE-2026-11774
  • CVE-2026-11785
  • CVE-2026-11786
  • CVE-2026-11787
  • CVE-2026-11788
  • CVE-2026-11789
  • CVE-2026-11790
  • CVE-2026-11791
  • CVE-2026-11792
  • CVE-2026-11793
  • CVE-2026-11884
  • CVE-2026-12528
Related
CVE (14)
  • CVE-2026-11610
  • CVE-2026-11611
  • CVE-2026-11774
  • CVE-2026-11785
  • CVE-2026-11786
  • CVE-2026-11787
  • CVE-2026-11788
  • CVE-2026-11789
  • CVE-2026-11790
  • CVE-2026-11791
  • CVE-2026-11792
  • CVE-2026-11793
  • CVE-2026-11884
  • CVE-2026-12528
Published
2026-07-20T15:10:54Z
Modified
2026-07-21T09:45:06Z
Summary
Security update for 389-ds
Details

This update for 389-ds fixes the following issues

  • Update to version 2.7.0~git212.9b0755edb.
  • CVE-2026-11610: heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (bsc#1270695).
  • CVE-2026-11611: content synchronization persistent search plugin can allow unbounded memory growth (bsc#1267975).
  • CVE-2026-11774: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (bsc#1268298).
  • CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure (bsc#1268065).
  • CVE-2026-11786: lack of length check can cause an out-of-bounds read (bsc#1268064).
  • CVE-2026-11787: lack of bounds check can lead to a heap buffer overread (bsc#1268062).
  • CVE-2026-11788: lack of allocation failure check can lead to NULL pointer dereference (bsc#1268057).
  • CVE-2026-11789: crafted SMD5 hash can lead to an integer underflow (bsc#1268058).
  • CVE-2026-11790: crafted password hash can cause excessive CPU consumption (bsc#1268060).
  • CVE-2026-11791: schema reload triggered during concurrent LDAP query traffic can lead to a use-after-free (bsc#1268047).
  • CVE-2026-11792: password value shorter than 23 characters can cause a heap buffer overflow (bsc#1268046).
  • CVE-2026-11793: crafted nsDS5ReplicaCredentials can lead to a stack buffer overflow (bsc#1268041).
  • CVE-2026-11884: remote code execution and denial of service via heap buffer overflow (bsc#1268115).
  • CVE-2026-12528: heap buffer overflows in __aclp__normalize_acltxt() (bsc#1268491).
References

Affected packages

SUSE:Linux Enterprise Module for Server Applications 15 SP7 / 389-ds

Package

Name
389-ds
Purl
pkg:rpm/suse/389-ds&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.7.0~git212.9b0755edb-150700.3.19.1

Ecosystem specific 

{
    "binaries":  [
        {
            "389-ds":  "2.7.0~git212.9b0755edb-150700.3.19.1",
            "389-ds-devel":  "2.7.0~git212.9b0755edb-150700.3.19.1",
            "lib389":  "2.7.0~git212.9b0755edb-150700.3.19.1",
            "libsvrcore0":  "2.7.0~git212.9b0755edb-150700.3.19.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3138-1.json"