Linux · Fedora · Security advisory · September 7, 2026

FEDORA-2026-0B8BC362B1: Security update for 12 packages

FEDORA-2026-0B8BC362B1, released September 7, 2026, fixes 15 CVEs across 12 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
15
9 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0085
58th percentile

Priority of the 15 CVEs

Patch now 0 Urgent 9 High 6 Routine 0

Fixed package versions

ProductReleaseFixed in
389-ds-baseFedora 433.1.5-4.fc43
389-ds-base-debuginfoFedora 433.1.5-4.fc43
389-ds-base-debugsourceFedora 433.1.5-4.fc43
389-ds-base-develFedora 433.1.5-4.fc43
389-ds-base-libsFedora 433.1.5-4.fc43
389-ds-base-libs-debuginfoFedora 433.1.5-4.fc43
389-ds-base-robdb-libsFedora 433.1.5-4.fc43
389-ds-base-robdb-libs-debuginfoFedora 433.1.5-4.fc43
389-ds-base-snmpFedora 433.1.5-4.fc43
389-ds-base-snmp-debuginfoFedora 433.1.5-4.fc43
cockpit-389-dsFedora 433.1.5-4.fc43
python3-lib389Fedora 433.1.5-4.fc43

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2026-76560 389-ds-base: Resolves: RHEL-245374 - 389-ds-base: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN [...9.8 0.0056 None reported
Urgent CVE-2026-19404 389-ds-base: 389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort CleanAllRUV replication ma...n/a 0.0043 None reported
Urgent CVE-2026-15041 389-ds-base: 389-ds-base: 389-ds-base: Non-constant-time comparison in PBKDF2-SHA256 password verificationn/a 0.0036 None reported
Urgent CVE-2026-11884 389-ds: remote code execution and denial of service via heap buffer overflow (bsc#1268115).n/a 0.0035 None reported
Urgent CVE-2026-11790 389-ds: crafted password hash can cause excessive CPU consumption (bsc#1268060).n/a 0.0029 None reported
Urgent CVE-2026-11789 389-ds: crafted SMD5 hash can lead to an integer underflow (bsc#1268058).n/a 0.0028 None reported
Urgent CVE-2026-11793 389-ds: crafted `nsDS5ReplicaCredentials` can lead to a stack buffer overflow (bsc#1268041).n/a 0.0028 None reported
Urgent CVE-2026-11792 389-ds: password value shorter than 23 characters can cause a heap buffer overflow (bsc#1268046).n/a 0.0026 None reported
Urgent CVE-2026-11611 389-ds: Content Synchronization persistent search plugin allows unbounded memory growth when an authenticatedn/a 0.0024 None reported
High CVE-2026-18453 389-ds: pre-authentication NULL pointer dereference via paged results and9.8 0.0085 None reported
High CVE-2026-18355 389-ds: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of9.8 0.0084 None reported
High CVE-2026-11774 389-ds: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow8.8 0.0068 None reported
High CVE-2026-69152 nodejs-nodemon: The brace-expansion library generates arbitrary strings containing a common prefix and suffix8.6 0.0065 None reported
High CVE-2026-11770 389-ds-base: A flaw was found in 389 Directory Server7.5 0.0053 None reported
High CVE-2026-11610 389-ds: missing bounds check in `sasl_io_recv()` can lead to a heap buffer overflow when processing a8.8 0.0049 None reported
Showing 1 to 15 of 15 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.