LDAP Message Injection Vulnerability in 389 Directory Server by Red Hat
CVE-2026-86345

9CRITICAL

Key Information:

Vendor

Red Hat
Status
Red Hat Directory Server 11
Red Hat Directory Server 12
Red Hat Directory Server 13
Red Hat Enterprise Linux 10
Vendor
CVE Published:
1 October 2026

What is CVE-2026-86345?

A vulnerability has been identified in the 389 Directory Server where plaintext bytes from a client connection are not properly discarded during the StartTLS negotiation. This oversight allows an on-path attacker to inject a crafted LDAP message that can interfere with the TLS upgrade process. As a result, when the server processes the malicious message post-upgrade, the response may be delivered to the client as if it were part of its own pending operation. This can mislead client applications into erroneously treating failed authentication attempts as successful, posing significant risks to data integrity and system security.

References

https://access.redhat.com/security/cve/CVE-2026-86345
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2529332
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank xclow3n for reporting this issue.
.