CVE-2026-11788— 389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser
Quick assessment
Affected
Red Hat Red Hat Directory Server 11.7 E4S for RHEL 8
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
389 Directory Server是389 Directory Server开源的一个高度可用、功能齐全、可靠和安全的LDAP服务器实现。 389 Directory Server存在代码问题漏洞，该漏洞源于取消引用控制插件在使用BER结构前未检查分配失败，允许未经身份验证的远程攻击者在系统内存压力下崩溃LDAP服务器。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 21
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-11788
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Vulnerability Title
389 Directory Server 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
389 Directory Server是389 Directory Server开源的一个高度可用、功能齐全、可靠和安全的LDAP服务器实现。 389 Directory Server存在代码问题漏洞，该漏洞源于取消引用控制插件在使用BER结构前未检查分配失败，允许未经身份验证的远程攻击者在系统内存压力下崩溃LDAP服务器。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Directory Server 11.7 E4S for RHEL 8 | 8080020260806114250.f969626e ~ * |
cpe:/a:redhat:directory_server_e4s:11.7::el8
|
|
| Red Hat | Red Hat Directory Server 11.9 for RHEL 8 | 8100020260803140625.37ed7c03 ~ * |
cpe:/a:redhat:directory_server:11.9::el8
|
|
| Red Hat | Red Hat Directory Server 12.2 E4S for RHEL 9 | 9020020260730155601.1674d574 ~ * |
cpe:/a:redhat:directory_server_e4s:12.2::el9
|
|
| Red Hat | Red Hat Directory Server 12.4 E4S for RHEL 9 | 9040020260810131422.1674d574 ~ * |
cpe:/a:redhat:directory_server_e4s:12.4::el9
|
|
| Red Hat | Red Hat Enterprise Linux 10 | 0:3.2.0-9.el10_2 ~ * |
cpe:/o:redhat:enterprise_linux:10.2
|
|
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | 0:3.0.6-20.el10_0 ~ * |
cpe:/o:redhat:enterprise_linux_eus:10.0
|
|
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | 0:1.3.11.1-14.el7_9 ~ * |
cpe:/o:redhat:rhel_els:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | 8100020260806150504.25e700aa ~ * |
cpe:/a:redhat:enterprise_linux:8::appstream
|
|
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | 8040020260803141511.96015a92 ~ * |
cpe:/a:redhat:rhel_aus:8.4::appstream
|
|
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | 8040020260803141511.96015a92 ~ * |
cpe:/a:redhat:rhel_aus:8.4::appstream
|
|
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | 8060020260806120442.824efc52 ~ * |
cpe:/a:redhat:rhel_aus:8.6::appstream
|
|
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | 8060020260806120442.824efc52 ~ * |
cpe:/a:redhat:rhel_aus:8.6::appstream
|
|
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | 8080020260806114228.6dbb3803 ~ * |
cpe:/a:redhat:rhel_e4s:8.8::appstream
|
|
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | 8080020260806114228.6dbb3803 ~ * |
cpe:/a:redhat:rhel_e4s:8.8::appstream
|
|
| Red Hat | Red Hat Enterprise Linux 9 | 0:2.8.0-9.el9_8 ~ * |
cpe:/a:redhat:enterprise_linux:9::appstream
|
|
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | 0:2.2.4-20.el9_2 ~ * |
cpe:/a:redhat:rhel_e4s:9.2::appstream
|
|
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | 0:2.4.5-27.el9_4 ~ * |
cpe:/a:redhat:rhel_e4s:9.4::appstream
|
|
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | 0:2.6.1-23.el9_6 ~ * |
cpe:/a:redhat:rhel_eus:9.6::appstream
|
|
| Red Hat | Red Hat Directory Server 12 | - |
cpe:/a:redhat:directory_server:12
|
|
| Red Hat | Red Hat Directory Server 13 | - |
cpe:/a:redhat:directory_server:13
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
II. Public POCs for CVE-2026-11788
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-11788
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-11788 (18)
-
-
-
-
🔗 RHSA-2026:55422 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
🔗 RHSA-2026:55421 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
🔗 RHSA-2026:55423 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
-
🔗 RHSA-2026:55794 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
🔗 RHSA-2026:55424 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
-
🔗 RHSA-2026:56048 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
🔗 RHSA-2026:56047 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
🔗 RHSA-2026:55758 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
-
-
🔗 RHSA-2026:55530 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
🔗 RHSA-2026:55532 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
🔗 RHSA-2026:55756 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-06-09 · 9 CVEs total
| CVE-2026-11787 | 5.0 MEDIUM | 389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter p |
| CVE-2026-11793 | 4.9 MEDIUM | 389-ds-base: 389-ds-base: stack buffer overflow in checkprefix() algorithm id parsing |
| CVE-2026-11790 | 4.9 MEDIUM | 389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial |
| CVE-2026-11789 | 4.9 MEDIUM | 389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash |
| CVE-2026-52902 | 4.7 MEDIUM | Awxkit: path traversal via yaml !include directive |
| CVE-2026-11785 | 4.3 MEDIUM | 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confu |
| CVE-2026-11792 | 3.3 LOW | 389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_maske |
| CVE-2026-11786 | 1.9 LOW | 389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_informati |
IV. Related Vulnerabilities
Same product: Red Hat Directory Server 11.7 E4S for RHEL 8
-
CVE-2026-19843
389-ds-base: 389-ds-base: command injection via unescaped ld -
CVE-2026-18922
389-ds-base: 389-ds-base: sasl plain authentication allows p -
CVE-2026-18453
389-ds-base: 389-ds-base: pre-authentication null pointer de -
CVE-2026-18355
389-ds-base: 389-ds-base: heap buffer overflow via sasl wrap -
CVE-2026-76560
389-ds-base: 389-ds: anonymous ldap client can defeat selfdn
Same vendor: Red Hat
-
CVE-2026-104988
Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentic -
CVE-2026-95512
Freetype: freetype: denial of service via repeated subroutin -
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retentio -
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool -
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50
Same weakness: CWE-476
-
CVE-2026-66859
Apache Thrift: c_glib multiplexed processor crashes on a mes -
CVE-2026-87117
Apache Thrift: PHP `thrift_protocol` accelerator dereference -
CVE-2026-82357
RT-Labs AB C-Open CANopen NULL pointer dereference -
CVE-2026-9032
Unauthenticated Onboarding Connect NULL Pointer Dereference -
CVE-2026-63686
Apache HTTP Server: mod_xml2enc crash on charset conversion
V. Comments for CVE-2026-11788
No comments yet