CVE-2026-11770: the replication extended operations did not
verify that the bind DN is accepted by the replica, and the
CleanRUV status filters were open to LDAP injection.
CVE-2026-18355: a missing minimum length check in
sasl_io_start_packet() lets an authenticated SASL user trigger
an unsigned integer underflow, causing heap corruption and a
crash of the server.
CVE-2026-18453: op_shared_search() does not check for a NULL
backend pointer when reusing a paged results slot, so an
unauthenticated client can crash ns-slapd with two search
requests on one connection. Paged results and anonymous access
are enabled by default.
CVE-2026-18922: a failed one-shot SASL exchange leaves stale
identity data in the auxprop context, so a later successful
bind on the same connection can inherit it and escalate to
Directory Manager.
CVE-2026-19843: the cockpit LDAP editor passed the entry DN
into a shell command line, so a user who can create or rename
an entry can have the host run commands as root when an
administrator opens that entry.
CVE-2026-76560: anonymous clients could satisfy SELFDN,
USERDNATTR and LDAPURL ACL bind rules, granting unauthorized
access.