CVE-2026-11785
published 2026-06-09CVE-2026-11785: A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.18%
7.7th percentile
A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| port389 | 389-ds-base | — | — |
| redhat-ds_12 | 389-ds-base | — | — |
| redhat | directory_server | — | — |
| redhat | directory_server | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in SSO token handler
vendor_redhat·2026-04-16·CVSS 4.3
CVE-2026-11785 [MEDIUM] CWE-843 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in SSO token handler
389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in SSO token handler
A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users.
Mitigation: Option 1 (Recommended): Disable the SSO token feature entirely: dsconf config replace nsslapd-enable-ldapssotoken=off. This prevents the vulnerable code path from being reached but disables SSO token functionality for all users. Option 2: Restrict network access to LDAP ports (389/636) to trusted networks via firewall rules. Note: Removing the SSO token secret from configuration does not mitigate the vulnerability — the server auto-generates a new secret at startu
GHSA
A flaw was found in 389 Directory Server.
ghsa_unreviewed·2026-06-09
CVE-2026-11785 [MEDIUM] CWE-843 A flaw was found in 389 Directory Server.
A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-11785 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in SSO token handler [fedora-all]
bugzilla·2026-06-30·CVSS 4.3
CVE-2026-11785 [MEDIUM] CVE-2026-11785 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in SSO token handler [fedora-all]
CVE-2026-11785 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in SSO token handler [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A type confusion bug in extop_handle_ldapssotoken_request() (extendop.c) passes a stack pointer (&rc) to ber_printf with format 'i' which expects an integer. The low 32 bits of a stack address are encoded into every SSO token LDAP extended operation response.
Any authenticated non-administrator user can extract partial stack address information. SSO token feature enabled by default with auto-generated secret (Issue #1797). Po
Bugzilla
CVE-2026-11785 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in SSO token handler
bugzilla·2026-06-05·CVSS 4.3
CVE-2026-11785 [MEDIUM] CVE-2026-11785 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in SSO token handler
CVE-2026-11785 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in SSO token handler
A type confusion bug in extop_handle_ldapssotoken_request() (extendop.c) passes a stack pointer (&rc) to ber_printf with format 'i' which expects an integer. The low 32 bits of a stack address are encoded into every SSO token LDAP extended operation response.
Any authenticated non-administrator user can extract partial stack address information. SSO token feature enabled by default with auto-generated secret (Issue #1797). PoC confirmed on Fedora 42: INTEGER=0x8e7faed8 leaked. Reduces stack ASLR entropy but is not a full bypass.
2026-06-09
Published