Directory server

This hub aggregates every CVE we track for Directory server, a product in the databases space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Directory server.

• CVE-2026-15041389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification3.7Jul 8, 2026
• CVE-2026-14969389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption4.4Jul 7, 2026
• CVE-2026-14940389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn5.3Jul 7, 2026
• CVE-2026-11791389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht()5.0Jun 18, 2026
• CVE-2026-12528389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()5.4Jun 17, 2026
• CVE-2026-11790389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service4.9Jun 9, 2026
• CVE-2026-11789389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash4.9Jun 9, 2026
• CVE-2026-11787389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing5.0Jun 9, 2026
• CVE-2026-11788389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser5.9Jun 9, 2026
• CVE-2026-11786389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()1.9Jun 9, 2026
• CVE-2026-11785389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handler4.3Jun 9, 2026
• CVE-2026-11611389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions6.5Jun 8, 2026
• CVE-2026-9064389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)7.5May 20, 2026
• CVE-2024-6237389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request6.5Jul 9, 2024
• CVE-2024-1062389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)5.5Feb 12, 2024