CVE-2026-11774

An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.

Red Hat rates this issue as Important. After a successful SASL bind with integrity protection, an authenticated attacker can send a SASL-framed packet whose length prefix wraps when processed in sasl_io_start_packet(), bypassing nsslapd-maxsasliosize and causing a heap buffer overflow of up to approximately two megabytes of attacker-controlled data.

This flaw is independent of CVE-2025-14905 (schema.c). Any domain user with a Kerberos ticket can trigger it remotely after GSSAPI authentication. Red Hat assigns C:L/I:L rather than Critical because remote code execution on current platforms with glibc 2.32+ is blocked by tcache safe linking; RCE was demonstrated on RHEL 8 with glibc 2.28 but required a heap address leak. Denial of service is reliable on all platforms.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No complete workaround exists; nsslapd-maxsasliosize is bypassed by the integer overflow. Mitigations that reduce exposure: restrict SASL mechanisms (disable DIGEST-MD5 if not required; GSSAPI cannot be disabled in FreeIPA/IdM without breaking Kerberos authentication); firewall LDAP ports (389/636) to trusted networks; monitor for SASL-framed packets with length prefix 0xFFFFFFFC through 0xFFFFFFFF; enable audit logging (nsslapd-auditlog-logging-enabled: on); on RHEL 8, upgrading glibc reduces RCE exploitability but does not eliminate DoS.