-
Tue Oct 20 2026 Viktor Ashirov <vashirov@redhat.com> - 3.2.0-12
- Bump version to 3.2.0-12
- Resolves: RHEL-234361 - Online reinitialization is failing with the
supplier being busy calling idrange_add_id() [rhel-10.2.z]
-
Tue Oct 13 2026 Viktor Ashirov <vashirov@redhat.com> - 3.2.0-11
- Bump version to 3.2.0-11
- Resolves: RHEL-213034 - Post-import cache autotuning does not recompute
entry cache size [rhel-10.2.z]
- Resolves: RHEL-216937 - Replication performance degradation during total
init on high-latency storage [rhel-10.2.z]
- Resolves: RHEL-218597 - ERR - idl_new_range_fetch - Failed to build range
candidate list on entryusn index [rhel-10.2.z]
- Resolves: RHEL-234361 - Online reinitialization is failing with the
supplier being busy calling idrange_add_id() [rhel-10.2.z]
- Resolves: RHEL-252645 - large IdM host group, missing memberof host
group, authentication failures, high traffic and contention [rhel-10.2.z]
- Resolves: RHEL-256989 - MOD_REPLACE on groups/link attributes modifies
overlap targets [rhel-10.2.z]
- Resolves: RHEL-257005 - WARN - keys2idl - received NULL idl from
index_read_ext_allids [rhel-10.2.z]
- Resolves: RHEL-267291 - dsEntryDN is being updated when nsslapd-return-
original-entrydn is set to off [rhel-10.2.z]
- Resolves: RHEL-267320 - When fetching an entry from the DB, if nsslapd-
return-original-entrydn is enabled return dsEntryDN rather than
normalized DN [rhel-10.2.z]
- Resolves: RHEL-267325 - Differences on export ldif using online of off-
line method on RHDS [rhel-10.2.z]
-
Wed Sep 02 2026 Viktor Ashirov <vashirov@redhat.com> - 3.2.0-10
- Bump version to 3.2.0-10
- Resolves: RHEL-220500 - CVE-2026-18355 389-ds-base: heap buffer overflow
via SASL wrapped-record length lower-bound underflow in
sasl_io_start_packet() [rhel-10.2.z]
- Resolves: RHEL-222320 - CVE-2026-18453 389-ds-base: pre-authentication
NULL pointer dereference via paged results and USE_ONE_BACKEND control in
op_shared_search [rhel-10.2.z]
- Resolves: RHEL-232863 - CVE-2026-18922 389-ds-base: SASL PLAIN
authentication allows privilege escalation to Directory Manager via stale
identity in Cyrus SASL auxiliary property [rhel-10.2.z]
- Resolves: RHEL-244470 - lib389: set nsDS5ReplicaBindDNGroup before
ensure_agreement() [rhel-10.2.z]
- Resolves: RHEL-245372 - CVE-2026-76560 389-ds-base: anonymous LDAP client
can defeat SELFDN ACI bind-rule checks via empty bind DN [rhel-10.2.z]
- Resolves: RHEL-247859 - CVE-2026-78701 389-ds-base: CVE-2026-11610
incomplete fix may introduce a connection-stall DoS [rhel-10.2.z]
- Resolves: RHEL-248770 - CVE-2026-11770 fix breaks replication total init
when nsDS5ReplicaBindDNGroup is set after agreement creation
[rhel-10.2.z]
-
Wed Jul 29 2026 Viktor Ashirov <vashirov@redhat.com> - 3.2.0-9
- Bump version to 3.2.0-9
- Resolves: RHEL-183075 - CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth
LDAP filter injection in CleanAllRUV status check [rhel-10.2.z]
- Resolves: RHEL-190776 - CVE-2026-11788 389-ds-base: 389-ds-base: NULL
pointer dereference in deref control plugin BER parser [rhel-10.2.z]
- Resolves: RHEL-210874 - CVE-2026-15722 389-ds-base: 389-ds-base: pre-
authentication stack buffer overflow in get_ruvelement_from_berval() via
unbounded replica ID parsing [rhel-10.2.z]
-
Fri Jun 26 2026 Viktor Ashirov <vashirov@redhat.com> - 3.2.0-8
- Bump version to 3.2.0-8
- Resolves: RHEL-182152 - CVE-2026-11610 389-ds-base: 389-ds-base: Heap
buffer overflow in sasl_io_recv() via padded SASL UNBIND [rhel-10.2.z]
- Resolves: RHEL-183105 - CVE-2026-11774 389-ds-base: 389-ds-base: integer
overflow in SASL packet length bypasses size limit leading to heap buffer
overflow [rhel-10.2.z]
-
Thu Jun 11 2026 Viktor Ashirov <vashirov@redhat.com> - 3.2.0-7
- Bump version to 3.2.0-7
- Resolves: RHEL-170271 - DS 12 does not handle escape char in bind user
[rhel-10.2.z]
- Resolves: RHEL-170276 - dnaSharedConfig: "dnaPortNum: 0" [rhel-10.2.z]
- Resolves: RHEL-170281 - Memory leaks in syncrepl plugin during persistent
search operations [rhel-10.2.z]
- Resolves: RHEL-170363 - access log - suspicious wtime optime negative
and large values in internal op [rhel-10.2.z]
- Resolves: RHEL-170478 - An online reinitialization with LMDB is
terminating the receiving server [rhel-10.2.z]
- Resolves: RHEL-170481 - dsctl healthcheck DSMOLE0001 inaccurate
recommendations when there is more than 1 LDAP backend [rhel-10.2.z]
- Resolves: RHEL-170515 - Possible memory leak when using the Retro
Changelog plugin. [rhel-10.2.z]
- Resolves: RHEL-174526 - [RFE] Add OS-level thread names to all server
threads [rhel-10.2.z]
- Resolves: RHEL-178074 - CVE-2026-9064 389-ds-base: 389-ds-base: unbounded
LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap
amplification (remote DoS) [rhel-10.2]
- Resolves: RHEL-180718 - Online export is failing when using the option
"-s" [rhel-10.2.z]
- Resolves: RHEL-183897 - Server shutdown during online reindex may lead to
data loss [rhel-10.2.z]
- Resolves: RHEL-183898 - Error: NssSsl.add_cert() got an unexpected
keyword argument 'input_file' [rhel-10.2.z]
- Resolves: RHEL-183899 - Replication errors in logs [rhel-10.2.z]
- Resolves: RHEL-183900 - Substring index produces empty results and can
crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured
[rhel-10.2.z]
-
Thu Mar 05 2026 Viktor Ashirov <vashirov@redhat.com> - 3.2.0-6
- Bump version to 3.2.0-6
- Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro
Changelog trimming.
-
Sat Feb 28 2026 Viktor Ashirov <vashirov@redhat.com> - 3.2.0-5
- Bump version to 3.2.0-5
-
Fri Feb 27 2026 Viktor Ashirov <vashirov@redhat.com> - 3.2.0-4
- Bump version to 3.2.0-4
- Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro
Changelog trimming.
- Resolves: RHEL-133085 - Replica installation is failing with message
MDB_BAD_VALSIZE: Unsupported size of key/DB name/data, or wrong DUPFIXED
- Resolves: RHEL-137072 - CVE-2025-14905 389-ds-base: 389-ds-base: Remote
Code Execution and Denial of Service via heap buffer overflow [rhel-10.2]
- Resolves: RHEL-138729 - Crash ( Segmentation fault ) in
atomic_compare_exchange()
-
Fri Feb 20 2026 Viktor Ashirov <vashirov@redhat.com> - 3.2.0-3
- Bump version to 3.2.0-3
- Resolves: RHEL-76835 - Web console doesn't show the sub suffix of
ou=foo,ou=people,dc=example,dc=com.
- Resolves: RHEL-86320 - [RFE] Support updating/renewing TLS certificate
without restarting slapd
- Resolves: RHEL-110192 - ns-slapd doesn't support PQC keys
- Resolves: RHEL-111220 - RHDS-11.9 dsctl db2index --attr recreates all
indexes instead of selected ones
- Resolves: RHEL-111931 - Improve error messages for dsconf localpwp list
- Resolves: RHEL-121981 - Setting password history count to 0 does not
flush history
- Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or
incorrectly configured system indexes.
- Resolves: RHEL-128906 - Scalability issue of replication online
initialization with large database
- Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and
ipa-server breaks replication
- Resolves: RHEL-146769 - Remove memberof_del_dn_from_groups from MemberOf
plugin