CVE-2026-11788
published 2026-06-09CVE-2026-11788: A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.35%
26.9th percentile
A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| port389 | 389-ds-base | — | — |
| redhat-ds_11 | 389-ds-base | — | — |
| redhat-ds_12 | 389-ds-base | — | — |
| redhat | directory_server | — | — |
| redhat | directory_server | — | — |
| redhat | directory_server | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in 389 Directory Server.
ghsa_unreviewed·2026-06-09
CVE-2026-11788 [MEDIUM] CWE-476 A flaw was found in 389 Directory Server.
A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.
Red Hat
389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser
vendor_redhat·2026-04-16·CVSS 5.9
CVE-2026-11788 [MEDIUM] CWE-476 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser
389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser
A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.
Mitigation: Disable the deref plugin (most effective): dsconf plugin deref disable; systemctl restart dirsrv@. Disable anonymous access (nsslapd-allow-anonymous-access=off) to raise the bar from pre-auth to authenticated exploitation. Configure memory limits as defense-in-depth: set nsslapd-maxbersize and nsslapd-conntablesize, and deploy in a cgroup with memory limits.
Package: redhat-ds:11/389-ds-base (Red Hat Directory Server 11) - Fix deferred
Packag
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser [fedora-all]
bugzilla·2026-06-30·CVSS 7.5
CVE-2026-11788 [HIGH] CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser [fedora-all]
CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The dereference control plugin in 389 Directory Server fails to check the return value of ber_init() for NULL before use in deref_parse_ctrl_value() (deref.c). When memory allocation fails under memory pressure, an unauthenticated LDAP client sending a search with the deref control can crash ns-slapd.
The deref plugin is enabled by default. Crash confirmed via GDB fault injection on Fedora 42 (SIGABRT) and CentOS 7 (SIGSEGV on OpenLDAP 2.4). Vulnerable co
Bugzilla
CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser
bugzilla·2026-06-05·CVSS 5.9
CVE-2026-11788 [MEDIUM] CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser
CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser
The dereference control plugin in 389 Directory Server fails to check the return value of ber_init() for NULL before use in deref_parse_ctrl_value() (deref.c). When memory allocation fails under memory pressure, an unauthenticated LDAP client sending a search with the deref control can crash ns-slapd.
The deref plugin is enabled by default. Crash confirmed via GDB fault injection on Fedora 42 (SIGABRT) and CentOS 7 (SIGSEGV on OpenLDAP 2.4). Vulnerable code present since deref plugin introduction in 389-ds-base 1.2.6 (~2010).
2026-06-09
Published