CVE-2026-11792: 389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_masked_entry_string)
A heap buffer overflow exists in 389 Directory Server's audit log password masking feature. The createmaskedentrystring() function (auditlog.c:109) uses strcpy to write a fixed 24-byte mask string into a precisely-sized heap buffer from slapientry2str(). When a password value is shorter than 23 characters, the copy overflows past the allocated buffer boundary.
Trigger conditions require non-default configuration: audit logging enabled AND either passwordStorageScheme=CLEAR (explicitly discouraged) or a compromised replication peer sending short cleartext passwords via replicated ADD (replop bypasses password hashing).
Introduced by commit bfeaa8d (Issue 6884, July 2025) and backported to RHEL 9.6 (RHEL-109954) and RHEL 10 (RHEL-107035). Not present in RHEL 7, RHEL 8, or RHEL 9.0-9.5.
Production testing: heap corruption confirmed in audit log output on live server; ASan PoC confirms overflow. Production binaries may absorb overflow in allocator padding without immediate crash.
Advisory: 389-ds-campaign-2026-04/006-Auditlog-Heap-Overflow/advisory.md. Source: PSIRTSUPT-7600 (Ian Murphy, Red Hat Product Security).
Other sources
A heap buffer overflow flaw was found in 389 Directory Server. When audit logging is enabled, the createmaskedentrystring() function in auditlog.c copies a fixed-length password mask into a precisely-sized heap buffer without checking available space. If a short cleartext password is logged (requiring non-default CLEAR password storage or a compromised replication peer), the copy overflows the buffer, corrupting heap memory and audit log output.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 389-ds-campaign-2026-04/006-Auditlog-Heap-Overflow/advisory.md - Configuration
If possible, disable audit logging on production instances to avoid triggering the heap buffer overflow in password masking (create_masked_entry_string in auditlog.c) until the advisory patch is applied. Trigger conditions require audit logging enabled.
389 Directory Server (audit logging) audit logging enabled = disabled - Compensating control
Mitigate the trigger by preventing replicated ADD operations from carrying short cleartext passwords. Ensure replication peers cannot bypass password hashing (repl_op bypasses password hashing when sending short cleartext passwords via replicated ADD) and avoid non-default cleartext password handling (passwordStorageScheme=CLEAR is explicitly discouraged).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11792?
The severity of CVE-2026-11792 is classified as low, with a score of 3.3.
How do I fix CVE-2026-11792?
To fix CVE-2026-11792, you should update your 389-ds-base software to the latest version provided by Red Hat.
What type of vulnerability is CVE-2026-11792?
CVE-2026-11792 is classified as a heap buffer overflow vulnerability.
What is affected by CVE-2026-11792?
CVE-2026-11792 affects the 389 Directory Server's audit log password masking feature.
What could happen if CVE-2026-11792 is exploited?
If exploited, CVE-2026-11792 may lead to potential unauthorized access due to heap buffer overflow.