A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting characters. When a large number of aliases are processed, this oversight can lead to a heap overflow, potentially allowing a remote attacker to cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE).
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade 389-ds-base-develUpgrade 389-ds-base-libsUpgrade 389-ds-base-legacy-toolsUpgrade 389-ds-baseUpgrade 389-ds-base-snmpUpgrade python3-lib389 | Feb 27, 2026 | Feb 24, 2026 |
| Amazon Linux Ami 2 | — | Upgrade 389-ds-baseUpgrade 389-ds-base-snmpUpgrade 389-ds-base-libsUpgrade 389-ds-base-develUpgrade 389-ds-base-debuginfo | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade 389-ds-base | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade 389-ds-base-legacy-toolsUpgrade 389-ds-baseUpgrade 389-ds-base-develUpgrade 389-ds-base-bdbUpgrade python3-lib389Upgrade 389-ds-base-snmpUpgrade 389-ds-base-libs | Feb 25, 2026 | Feb 23, 2026 |
| Redhat_linux | — | Upgrade python3-lib389Upgrade 389-ds-base-snmpUpgrade 389-ds-base-snmp-debuginfoUpgrade 389-ds-base-debuginfoUpgrade 389-ds-base-libs-debuginfoUpgrade 389-ds-baseNo solution existsUpgrade 389-ds-base-legacy-toolsUpgrade 389-ds-base-bdbUpgrade 389-ds-base-debugsourceUpgrade 389-ds-base-develUpgrade 389-ds-base-bdb-debuginfoUpgrade 389-ds-base-libsUpgrade 389-ds-base-legacy-tools-debuginfo | Feb 26, 2026 | Feb 23, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub