Riskcovery

CVE-2026-86345

389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result

State
Published
Severity
9.0 Critical
Published
Oct 1, 2026
Updated
Oct 7, 2026
Reserved
Sep 7, 2026

Read the record on cve.org

Description

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in place of the client's own pending operation's response, due to messageID collision. This can cause a client application to treat a failed authentication (bind) attempt as successful.

Scores

CVSSScoreVectorSource
3.19.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hredhat

Weaknesses

  • CWE-923 Improper Restriction of Communication Channel to Intended Endpoints

Affected Products

ProductVersions
Red Hat Directory Server 11Red Hat
    Red Hat Directory Server 11Red Hat
      Red Hat Directory Server 12Red Hat
        Red Hat Directory Server 12Red Hat
          Red Hat Directory Server 13Red Hat
            Red Hat Enterprise Linux 10Red Hat
              Red Hat Enterprise Linux 6Red Hat
                Red Hat Enterprise Linux 7Red Hat
                  Red Hat Enterprise Linux 8Red Hat
                    Red Hat Enterprise Linux 8Red Hat
                      Red Hat Enterprise Linux 9Red Hat

                        References

                        Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.