CVE-2026-11788: 389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-09 · updated 2026-10-08
Weakness: CWE-476

Description

A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.

Affected products

Red Hat 389 Directory Server: all versions
RedHat Directory Server: 11.0, 12.0, 13.0
Red Hat Enterprise Linux: 7.0, 8.0, 9.0, 10.0

References

https://access.redhat.com/errata/RHSA-2026:55421
https://access.redhat.com/errata/RHSA-2026:55422
https://access.redhat.com/errata/RHSA-2026:55423
https://access.redhat.com/errata/RHSA-2026:55424
https://access.redhat.com/errata/RHSA-2026:55425
https://access.redhat.com/errata/RHSA-2026:55426
https://access.redhat.com/errata/RHSA-2026:55530
https://access.redhat.com/errata/RHSA-2026:55532
https://access.redhat.com/errata/RHSA-2026:55756
https://access.redhat.com/errata/RHSA-2026:55757
https://access.redhat.com/errata/RHSA-2026:55758
https://access.redhat.com/errata/RHSA-2026:55794

Get alerted when CVE-2026-11788 or the next vulnerability affects your stack