Vulnerability Description
A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Directory Server | 11.0 |
| Redhat | 389 Directory Server | - |
| Redhat | Enterprise Linux | 7.0 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2026:55421
- https://access.redhat.com/errata/RHSA-2026:55422
- https://access.redhat.com/errata/RHSA-2026:55423
- https://access.redhat.com/errata/RHSA-2026:55424
- https://access.redhat.com/errata/RHSA-2026:55425
- https://access.redhat.com/errata/RHSA-2026:55426
- https://access.redhat.com/errata/RHSA-2026:55530
- https://access.redhat.com/errata/RHSA-2026:55532
- https://access.redhat.com/errata/RHSA-2026:55756
- https://access.redhat.com/errata/RHSA-2026:55757
- https://access.redhat.com/errata/RHSA-2026:55758
- https://access.redhat.com/errata/RHSA-2026:55794
- https://access.redhat.com/errata/RHSA-2026:56047
- https://access.redhat.com/errata/RHSA-2026:56048
- https://access.redhat.com/errata/RHSA-2026:56050
FAQ
What is CVE-2026-11788?
CVE-2026-11788 is a vulnerability with a CVSS score of 5.9 (MEDIUM). A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LD...
How severe is CVE-2026-11788?
CVE-2026-11788 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-11788?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Directory Server, Redhat 389 Directory Server, Redhat Enterprise Linux.