A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in place of the client's own pending operation's response, due to messageID collision. This can cause a client application to treat a failed authentication (bind) attempt as successful.
Critical 9.0
CVE-2026-86345
Red Hat Red Hat Directory Server 11 — The server does not discard plaintext bytes already buffered from a client connection when…
The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and…
WeaknessCWE-923
Published Updated Source NVD
CVSS 3.1
9.0
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploit chance, 30 days
0.4%
Higher than 32% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run Red Hat Directory Server 11, and which version.
- 02Follow the vendor advisory for a fix or a workaround.
References
Timeline · UTC
- Published to NVD
- NVD record updated
Also actively exploited
Other CVEs from Red Hat
9 more CVEs, 2 actively exploited
7.8Red Hat Automatic Bug Reporting Tool — Privilege Escalation.ExploitedEPSS 5.0%7.4Red Hat Libuser — Race Condition.ExploitedEPSS 8.5%9.1Red Hat OpenShift AI (RHOAI) — authorization bypass.EPSS 0.2%9.9Red Hat StreamsHub Console for Apache Kafka® — privilege escalation.EPSS 0.3%9.1Red Hat Red Hat build of Quarkus 3.27.6.redhat — This vulnerability allows unauthenticated attackers to bypass security controls on generated…EPSS 0.4%9.3Red Hat Build of Podman Desktop — path traversal.EPSS 0.2%