CVE-2026-11788

HighCVSS 7.5/10Last modified Nov 5, 2026

Description

A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
Red HatRed Hat Directory Server 11.5 E4S for RHEL 8—
Red HatRed Hat Directory Server 11.7 E4S for RHEL 8—
Red HatRed Hat Directory Server 11.9 for RHEL 8—
Red HatRed Hat Directory Server 12.2 E4S for RHEL 9—
Red HatRed Hat Directory Server 12.4 E4S for RHEL 9—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Directory Server 12—
Red HatRed Hat Directory Server 13—
Red HatRed Hat Enterprise Linux 6—

References

Timeline

Published
Jun 9, 2026
Last modified
Nov 5, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-1178806.3Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, anCVE-2026-1178818.8Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, ThundeCVE-2026-1178826.3Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159,CVE-2026-1178838.8Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, ThundeCVE-2026-1178848.8Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird CVE-2026-1178856.3Use-after-free in the Layout: Grid component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and ThunderbiCVE-2026-1178868.1Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR CVE-2026-1178878.8Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, ThundeCVE-2026-1178885.4Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, aCVE-2026-1178897.3Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ECVE-2026-117896.5A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length frCVE-2026-1178907.3JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159,
CVE-2026-11788: High severity, CVSS 7.5 | Vulnix