SASL Heap Buffer Overflow in 389 Directory Server

CVE-2026-11610 is a heap buffer overflow vulnerability in the SASL I/O layer of 389 Directory Server that allows authenticated attackers to crash the service by sending oversized LDAP UNBIND packets. The vulnerability exists in the sasl_io_recv() function, which copies incoming data into a fixed 512-byte buffer without validating packet size, permitting up to 2 megabytes of malicious data to overflow the heap. This affects organizations running 389 Directory Server with SASL integrity protection enabled (SSF > 0), making it particularly dangerous for enterprises using LDAP for authentication and directory services. While the CVSS score of 8.8 reflects high severity, the requirement for prior authentication limits immediate exposure—however, compromised user accounts or insider threats can trivially exploit this for denial of service.

Although this CVE maps to CWE-122 (heap buffer overflow) rather than discrete MITRE ATT&CK techniques, Casky's security skills library—powered by Claude's extended reasoning—would detect the attack patterns associated with exploitation. Practitioners using Casky would observe findings related to T1498 (Network Denial of Service) through resource exhaustion via malformed protocol packets, and potentially T1021.2 (SSH/LDAP protocol abuse) when analyzing network traffic containing oversized UNBIND frames sent post-authentication. The platform's 754 mapped skills would flag suspicious authentication sequences followed by abnormal packet structures, server process crashes correlated with specific LDAP client behavior, and heap memory corruption indicators in system logs—enabling defenders to correlate authentication logs with service interruptions and identify compromised accounts attempting exploitation.