Red hat directory server 12

This hub aggregates every CVE we track for Red hat directory server 12, a product in the databases space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Red hat directory server 12.

• CVE-2026-19843389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor8.4Sep 7, 2026
• CVE-2026-18922389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property9.8Sep 7, 2026
• CVE-2026-18453389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search7.5Sep 7, 2026
• CVE-2026-18355389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()7.5Sep 7, 2026
• CVE-2026-76560389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn7.5Sep 7, 2026
• CVE-2026-78701389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos6.5Aug 25, 2026
• CVE-2026-18663389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking control5.9Aug 12, 2026
• CVE-2026-19404389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance6.5Aug 10, 2026
• CVE-2026-18651389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account5.4Aug 3, 2026
• CVE-2026-11770389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check7.5Jul 31, 2026
• CVE-2026-15722389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing7.5Jul 31, 2026
• CVE-2026-16560389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued rdn5.3Jul 22, 2026
• CVE-2026-15041389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification3.7Jul 8, 2026
• CVE-2026-14969389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption4.4Jul 7, 2026
• CVE-2026-14940389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn5.3Jul 7, 2026