What’s Vulnerable › Vulnerabilities

CVE-2026-117548: 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-29 · updated 2026-10-29
• Weakness: CWE-476

Description

A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as "commonName") instead of its canonical name (such as "cn") as the new relative distinguished name. An authenticated attacker with the ModifyDN (rename) permission on the affected entry can use this flaw to crash the directory server, causing a denial of service.

Affected products

• Red Hat Directory Server 11: all versions
• Red Hat Directory Server 12: all versions
• Red Hat Directory Server 13: all versions
• Red Hat Enterprise Linux 10: all versions
• Red Hat Enterprise Linux 7: all versions
• Red Hat Enterprise Linux 8: all versions
• Red Hat Enterprise Linux 9: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-117548
• https://bugzilla.redhat.com/show_bug.cgi?id=2561778

Get alerted when CVE-2026-117548 or the next vulnerability affects your stack