Directory server

This hub aggregates every CVE we track for Directory server, a product in the databases space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Directory server.

• CVE-2026-18651389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account5.4Aug 3, 2026
• CVE-2026-11770389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check7.5Jul 31, 2026
• CVE-2026-15722389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing7.5Jul 31, 2026
• CVE-2026-15041389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification3.7Jul 8, 2026
• CVE-2026-14969389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption4.4Jul 7, 2026
• CVE-2026-14940389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn5.3Jul 7, 2026
• CVE-2026-11791389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht()5.0Jun 18, 2026
• CVE-2026-12528389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()5.4Jun 17, 2026
• CVE-2026-11790389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service4.9Jun 9, 2026
• CVE-2026-11789389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash4.9Jun 9, 2026
• CVE-2026-11788389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser5.9Jun 9, 2026
• CVE-2026-11787389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing5.0Jun 9, 2026
• CVE-2026-11786389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()1.9Jun 9, 2026
• CVE-2026-11785389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handler4.3Jun 9, 2026
• CVE-2026-11611389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions6.5Jun 8, 2026