SUSE-SU-2026:3138-1: 389-ds&distro=SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise

CVSS: UnknownPublished
Published 20-07-2026Last modified 21-07-2026
Open JSON

Vulnerability summary

SUSE-SU-2026:3138-1 is a vulnerability in 389-ds&distro=SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise with no CVSS score yet.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 14 · Downstream 0 · Related 14
CVE-2026-11610CVE-2026-11611CVE-2026-11774CVE-2026-11785CVE-2026-11786CVE-2026-11787

Timeline

  1. 20-07-2026
    PublishedVulnerability first disclosed.
  2. 21-07-2026
    Last modifiedVulnerability information updated.

Description

Security update for 389-ds This update for 389-ds fixes the following issues - Update to version 2.7.0~git212.9b0755edb. - CVE-2026-11610: heap buffer overflow in `sasl_io_recv()` via padded SASL UNBIND (bsc#1270695). - CVE-2026-11611: content synchronization persistent search plugin can allow unbounded memory growth (bsc#1267975). - CVE-2026-11774: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (bsc#1268298). - CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure (bsc#1268065). - CVE-2026-11786: lack of length check can cause an out-of-bounds read (bsc#1268064). - CVE-2026-11787: lack of bounds check can lead to a heap buffer overread (bsc#1268062). - CVE-2026-11788: lack of allocation failure check can lead to NULL pointer dereference (bsc#1268057). - CVE-2026-11789: crafted SMD5 hash can lead to an integer underflow (bsc#1268058). - CVE-2026-11790: crafted password hash can cause excessive CPU consumption (bsc#1268060). - CVE-2026-11791: schema reload triggered during concurrent LDAP query traffic can lead to a use-after-free (bsc#1268047). - CVE-2026-11792: password value shorter than 23 characters can cause a heap buffer overflow (bsc#1268046). - CVE-2026-11793: crafted `nsDS5ReplicaCredentials` can lead to a stack buffer overflow (bsc#1268041). - CVE-2026-11884: remote code execution and denial of service via heap buffer overflow (bsc#1268115). - CVE-2026-12528: heap buffer overflows in `__aclp__normalize_acltxt()` (bsc#1268491).

CVSS metrics

Risk metrics not yet published.

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Suse1 product
  • 389-ds&distro=SUSE Linux Enterprise Module for Server Applications 15 SP7< 2.7.0~git212.9b0755edb-150700.3.19.1

1 vendor · 1 product

References

30 links
Show all 30 references