CVE-2026-11786
published 2026-06-09CVE-2026-11786: A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during…
PriorityP336medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.16%
5.6th percentile
A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during database import, causing an out-of-bounds read detectable under memory instrumentation.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| port389 | 389-ds-base | — | — |
| redhat-ds_11 | 389-ds-base | — | — |
| redhat-ds_12 | 389-ds-base | — | — |
| redhat | directory_server | — | — |
| redhat | directory_server | — | — |
| redhat | directory_server | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vendor_redhat1.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in 389 Directory Server.
ghsa_unreviewed·2026-06-09
CVE-2026-11786 [LOW] CWE-125 A flaw was found in 389 Directory Server.
A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during database import, causing an out-of-bounds read detectable under memory instrumentation.
Red Hat
389-ds-base: 389-ds-base: heap out-of-bounds read in LDIF parser str2entry_state_information_from_type()
vendor_redhat·2026-04-16·CVSS 1.9
CVE-2026-11786 [LOW] CWE-125 389-ds-base: 389-ds-base: heap out-of-bounds read in LDIF parser str2entry_state_information_from_type()
389-ds-base: 389-ds-base: heap out-of-bounds read in LDIF parser str2entry_state_information_from_type()
A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during database import, causing an out-of-bounds read detectable under memory instrumentation.
Mitigation: Validate LDIF files for malformed attribute types before importing. Reject any LDIF entry containing attribute types with trailing semicolons (e.g., userCertificate;binary;). Pre-import validation: grep -nE '^[a-zA-Z][a-zA-Z0-9-]*;[^:]*;:' input.ldif && echo "REJECT: trailing semicolon in attribute type". This does not protect against the replication changelog path (corrupted stored data), but that path requires pre-existing databa
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-11786 389-ds-base: 389-ds-base: heap out-of-bounds read in LDIF parser str2entry_state_information_from_type() [fedora-all]
bugzilla·2026-06-30·CVSS 6.5
CVE-2026-11786 [MEDIUM] CVE-2026-11786 389-ds-base: 389-ds-base: heap out-of-bounds read in LDIF parser str2entry_state_information_from_type() [fedora-all]
CVE-2026-11786 389-ds-base: 389-ds-base: heap out-of-bounds read in LDIF parser str2entry_state_information_from_type() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap out-of-bounds read exists in str2entry_state_information_from_type() (entry.c) in the 389 Directory Server LDIF parser. When importing LDIF with attribute types containing trailing semicolons, the code accesses p[3] through p[6] after finding a semicolon via PL_strchr without verifying sufficient bytes remain in the allocation.
Requires local administrator access via ldif2db import. ASan-proven on instrumented builds; production
Bugzilla
CVE-2026-11786 389-ds-base: 389-ds-base: heap out-of-bounds read in LDIF parser str2entry_state_information_from_type()
bugzilla·2026-06-05·CVSS 1.9
CVE-2026-11786 [LOW] CVE-2026-11786 389-ds-base: 389-ds-base: heap out-of-bounds read in LDIF parser str2entry_state_information_from_type()
CVE-2026-11786 389-ds-base: 389-ds-base: heap out-of-bounds read in LDIF parser str2entry_state_information_from_type()
A heap out-of-bounds read exists in str2entry_state_information_from_type() (entry.c) in the 389 Directory Server LDIF parser. When importing LDIF with attribute types containing trailing semicolons, the code accesses p[3] through p[6] after finding a semicolon via PL_strchr without verifying sufficient bytes remain in the allocation.
Requires local administrator access via ldif2db import. ASan-proven on instrumented builds; production binaries do not crash due to allocator padding. Present unchanged across all shipped 389-ds-base versions.
2026-06-09
Published