CVE-2026-11788 MEDIUM

CVE-2026-11788: 389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser

Vendor Red Hat
Product Red Hat Directory Server 11
Weakness CWE-476
Published June 9, 2026
Last update June 9, 2026
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.

Key dates

02Disclosure timeline

June 9, 2026 CVE published
June 9, 2026 Record updated