Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-11884— 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation

Quick assessment

Affected
Red Hat Red Hat Directory Server 11
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

389 Directory Server是389 Directory Server开源的一个高度可用、功能齐全、可靠和安全的LDAP服务器实现。 389 Directory Server存在安全漏洞，该漏洞源于序列化对象类定义时未将oc_superior字段长度纳入缓冲区大小计算，可能导致具有目录管理器权限的攻击者通过创建长SUP值的对象类触发服务器崩溃。

CVSS 6.5 · Medium EPSS 0.35% · P26

Affected Version Matrix 8

VendorProduct Version RangeStatus
Red Hat Red Hat Directory Server 11 any affected
Red Hat Red Hat Directory Server 12 any affected
Red Hat Red Hat Directory Server 13 any affected
Red Hat Red Hat Enterprise Linux 10 any affected
Red Hat Red Hat Enterprise Linux 6 any unknown
Red Hat Red Hat Enterprise Linux 7 any affected
Red Hat Red Hat Enterprise Linux 8 any affected
Red Hat Red Hat Enterprise Linux 9 any affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-11884

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation
Source: CVE Program / CVE List V5
Vulnerability Description
A heap buffer overflow flaw was found in 389 Directory Server. When serializing objectclass definitions, the oc_superior (SUP) field length is omitted from buffer size calculations in read_schema_dse() and schema_oc_to_string(), but the field is still written via strcat(). An attacker with Directory Manager privileges, or a compromised replication supplier, can trigger a server crash by creating objectclasses with long SUP values. This is an incomplete fix variant of CVE-2025-14905.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Vulnerability Title
389 Directory Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
389 Directory Server是389 Directory Server开源的一个高度可用、功能齐全、可靠和安全的LDAP服务器实现。 389 Directory Server存在安全漏洞，该漏洞源于序列化对象类定义时未将oc_superior字段长度纳入缓冲区大小计算，可能导致具有目录管理器权限的攻击者通过创建长SUP值的对象类触发服务器崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Directory Server 11 - cpe:/a:redhat:directory_server:11
Red Hat Red Hat Directory Server 12 - cpe:/a:redhat:directory_server:12
Red Hat Red Hat Directory Server 13 - cpe:/a:redhat:directory_server:13
Red Hat Red Hat Enterprise Linux 10 - cpe:/o:redhat:enterprise_linux:10
Red Hat Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6
Red Hat Red Hat Enterprise Linux 7 - cpe:/o:redhat:enterprise_linux:7
Red Hat Red Hat Enterprise Linux 8 - cpe:/o:redhat:enterprise_linux:8
Red Hat Red Hat Enterprise Linux 9 - cpe:/o:redhat:enterprise_linux:9

II. Public POCs for CVE-2026-11884

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-11884

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-11884 (3)

Same Patch Batch · Red Hat · 2026-06-10 · 3 CVEs total

CVE-2026-6893 7.5 HIGH Dracut: dracut: root code execution via dhcp options command injection
CVE-2026-11837 7.3 HIGH Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation

IV. Related Vulnerabilities

Same product: Red Hat Directory Server 11
Same vendor: Red Hat
Same weakness: CWE-122

V. Comments for CVE-2026-11884

No comments yet

Leave a comment