← Vulnerability feed

Vulnerability record · CVE-2026-11793 · published 9 June 2026

CVE-2026-11793: Redhat 389 directory server stack-based buffer overflow vulnerability

Redhat · 389 Directory Server

A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix() function in pw.c copies an attacker-controlled algorithm ID into a 256-byte stack buffer without bounds checking when parsing reversible-encrypted attribute values. An attacker with Directory Manager privileges can crash the LDAP server by storing a crafted credential with an oversized algorithm ID. FORTIFY_SOURCE mitigates this to denial of service only.

4.9 CVSS 3.1 Medium EPSS 0.28% · top 81.4% CWE-121 · Stack-based buffer overflow
4.9CVSS 3.1 base score
0.28%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
7 Aug 2026Last modified by NVD

Description

A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix() function in pw.c copies an attacker-controlled algorithm ID into a 256-byte stack buffer without bounds checking when parsing reversible-encrypted attribute values. An attacker with Directory Manager privileges can crash the LDAP server by storing a crafted credential with an oversized algorithm ID. FORTIFY_SOURCE mitigates this to denial of service only.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://access.redhat.com/security/cve/CVE-2026-11793 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2484914 Issue TrackingVendor Advisory

Track CVE-2026-11793 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-11770Redhat directory server ldap injection vulnerabilityA flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-c…EPSS 0.53%7.5CVE-2026-15722Redhat directory server stack-based buffer overflow vulnerabilityA stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit c…EPSS 0.83%7.5CVE-2026-11788Redhat directory server null pointer dereference vulnerabilityA flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing…EPSS 0.56%7.5CVE-2026-9064Redhat directory server allocation without limits vulnerabilityA flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of cont…EPSS 1.1%7.5CVE-2022-1949Redhat 389 directory server insecure direct object reference vulnerabilityAn access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progr…EPSS 1.5%7.5CVE-2010-2222Redhat directory server null pointer dereference vulnerabilityThe _ger_parse_control function in Red Hat Directory Server 8 and the 389 Directory Server allows attackers to cause a denial of service (NULL pointe…EPSS 1.3%6.5CVE-2026-11789Redhat directory server vulnerabilityA flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a craf…EPSS 0.28%6.5CVE-2026-11786Redhat directory server out-of-bounds read vulnerabilityA flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolon…EPSS 0.16%

Source: NIST National Vulnerability Database (record CVE-2026-11793), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.