389-ds-base: 389-ds-base: stack buffer overflow in checkprefix() algorithm id parsing
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Deferred Red Hat: fix deferred
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-121 and the CVSS impact.
Summary
A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix() function in pw.c copies an attacker-controlled algorithm ID into a 256-byte stack buffer without bounds checking when parsing reversible-encrypted attribute values. An attacker with Directory Manager privileges can crash the LDAP server by storing a crafted credential with an oversized algorithm ID. FORTIFY_SOURCE mitigates this to denial of service only.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Directory Server 11 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Directory Server 12 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Directory Server 13 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | No fix listed | CNA |
- Red Hat Directory Server 11 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Directory Server 12 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Directory Server 13 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Directory Server 11 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 12 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 13 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-11793
- 2026-10-03 Alias added: GHSA-v6v5-66j3-444p
References
More Red Hat 389 Directory Server vulnerabilities
- TI-2026-13229 Stack-based buffer overflow in Red Hat Directory Server 11.5 E4S for RHEL 8 CVSS 3.1HIGH 7.5
- TI-2026-07965 Resource allocation without limits in 389-ds-base CVSS 3.1HIGH 7.5
- TI-2026-10157 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check CVSS 3.1HIGH 7.5
- TI-2024-05784 389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request CVSS 3.1MEDIUM 6.5
- TI-2022-01808 Authorization bypass in 389-ds-base CVSS 3.1HIGH 7.5
- TI-2010-02131 NULL pointer dereference in Red Hat Directory Server CVSS 3.1HIGH 7.5
Sources
- CVE-2026-11793 · CVE Program
- CVE-2026-11793 · NVD
- FIRST EPSS
- GHSA-v6v5-66j3-444p · GitHub Advisory Database · CC BY 4.0
- CVE-2026-11793 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences