CVE-2026-11789
published 2026-06-09CVE-2026-11789: A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a crafted…
PriorityP338medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.28%
20.2th percentile
A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a crafted password hash shorter than 16 bytes, causing a buffer over-read that crashes the LDAP server during authentication.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| port389 | 389-ds-base | — | — |
| redhat-ds_11 | 389-ds-base | — | — |
| redhat-ds_12 | 389-ds-base | — | — |
| redhat | directory_server | — | — |
| redhat | directory_server | — | — |
| redhat | directory_server | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in 389 Directory Server.
ghsa_unreviewed·2026-06-09
CVE-2026-11789 [MEDIUM] CWE-191 A flaw was found in 389 Directory Server.
A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a crafted password hash shorter than 16 bytes, causing a buffer over-read that crashes the LDAP server during authentication.
Red Hat
389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash
vendor_redhat·2026-04-16·CVSS 4.9
CVE-2026-11789 [MEDIUM] CWE-191 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash
389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash
A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a crafted password hash shorter than 16 bytes, causing a buffer over-read that crashes the LDAP server during authentication.
Mitigation: Disable nsslapd-allow-hashed-passwords (default: off) to prevent non-DM users from setting pre-hashed passwords. Restrict Directory Manager credentials; limit DM access to management networks and audit DM operations via nsslapd-auditlog. Monitor for suspicious userPassword modifications. Migrate stored passwords from {SMD5} to {PBKDF2_SHA256} to eliminate the vulnerable code path for existing accounts.
Package: redhat-ds:
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash [fedora-all]
bugzilla·2026-06-30·CVSS 5.7
CVE-2026-11789 [MEDIUM] CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash [fedora-all]
CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The SMD5 password storage plugin in 389 Directory Server computes salt length by subtracting MD5_LENGTH (16) from the decoded hash length using unsigned 32-bit arithmetic. When the stored hash is shorter than 16 bytes, the subtraction wraps to approximately 4GB. PK11_DigestOp() then reads from a small stack buffer into unmapped memory, crashing ns-slapd with SIGSEGV.
An attacker with Directory Manager privileges plants a crafted SMD5 hash; any subseq
Bugzilla
CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash
bugzilla·2026-06-05·CVSS 5.7
CVE-2026-11789 [MEDIUM] CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash
CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash
The SMD5 password storage plugin in 389 Directory Server computes salt length by subtracting MD5_LENGTH (16) from the decoded hash length using unsigned 32-bit arithmetic. When the stored hash is shorter than 16 bytes, the subtraction wraps to approximately 4GB. PK11_DigestOp() then reads from a small stack buffer into unmapped memory, crashing ns-slapd with SIGSEGV.
An attacker with Directory Manager privileges plants a crafted SMD5 hash; any subsequent BIND triggers instant crash. Missed variant of CVE-2024-5953 which patched md5_pwd.c and pbkdf2_pwd.c but not smd5_pwd.c.
Present since smd5_pwd.c creation (~2005). PoC confirmed on Fedora 42 production binary.
2026-06-09
Published