CVE-2026-11611: 389 Directory Server DoS Vulnerability

CVE-2026-11611 Overview

CVE-2026-11611 is a denial-of-service vulnerability in the 389 Directory Server, an enterprise-class Lightweight Directory Access Protocol (LDAP) server. The flaw resides in the Content Synchronization persistent search plugin. An authenticated client that stops reading sync responses causes unbounded memory growth on the server, eventually exhausting available memory. Additional race conditions in the plugin thread lifecycle can trigger crashes during connection teardown or server shutdown. The issue is classified under CWE-400 Uncontrolled Resource Consumption.

Critical Impact
An authenticated attacker can exhaust server memory or trigger crashes, disrupting directory services that underpin authentication and identity workflows.

Affected Products

389 Directory Server (Content Synchronization persistent search plugin)
Red Hat Directory Server distributions bundling the affected plugin
Downstream LDAP services that depend on 389-ds for identity operations

Discovery Timeline

2026-06-08 - CVE-2026-11611 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11611

Vulnerability Analysis

The 389 Directory Server supports LDAP Content Synchronization (syncrepl) through a persistent search plugin. When a client issues a sync request, the server streams change notifications back over the connection. The plugin queues outbound sync entries for delivery to the client. If the client stops reading from the socket but keeps the connection open, the server continues appending entries to the queue without an upper bound. Memory usage grows linearly with directory activity until the server process is killed by the operating system or becomes unresponsive.

A second class of defects affects the plugin thread lifecycle. Race conditions between worker threads and connection teardown can dereference freed structures during shutdown, producing crashes.

Root Cause

The primary root cause is missing flow control. The persistent search plugin lacks a backpressure mechanism or a queue cap that would discard, throttle, or terminate slow consumers. The secondary root cause is unsynchronized access to plugin state during thread exit, where teardown ordering does not guarantee that all references are released before structures are freed.

Attack Vector

Exploitation requires network access to the LDAP service and valid authenticated credentials with permission to issue Content Synchronization requests. An attacker opens a sync session, advertises a working consumer, and then halts reads on the socket while keeping the TCP connection alive. As directory modifications accumulate, the server buffers responses indefinitely. The same authenticated channel can be cycled to trigger the thread lifecycle race during repeated teardowns, increasing the likelihood of a crash.

No public proof-of-concept exploit has been published. See the Red Hat advisory for CVE-2026-11611 for upstream technical detail.

Detection Methods for CVE-2026-11611

Indicators of Compromise

Sustained growth in resident memory of the ns-slapd process without a corresponding increase in active client operations
Long-lived LDAP connections issuing Content Synchronization (syncrepl) controls with little or no data read back from the server socket
Repeated ns-slapd crashes or unexpected restarts during connection close or service shutdown

Detection Strategies

Monitor 389-ds access logs for SRCH operations carrying the 1.3.6.1.4.1.4203.1.9.1.1 sync request control and correlate with per-connection send-queue depth
Alert on individual LDAP connections that retain large server-side buffers while showing low or zero socket read activity
Track ns-slapd process restarts and core dumps, particularly those occurring during shutdown or signal handling

Monitoring Recommendations

Enable verbose plugin logging for the Content Synchronization plugin and ship logs to a centralized analytics platform
Baseline normal sync consumer behavior, including expected memory footprint and queue depth, and alert on deviations
Watch operating system memory pressure metrics on directory servers and tie thresholds to service-availability runbooks

How to Mitigate CVE-2026-11611

Immediate Actions Required

Apply the fixed 389-ds package from your distribution as soon as it is published; track status through the Red Hat CVE-2026-11611 page
Audit which accounts can initiate Content Synchronization sessions and remove the privilege from accounts that do not require it
Restrict network access to the LDAP port to known replication and application hosts

Patch Information

Red Hat tracks the issue in Bugzilla 2485424 and PSIRT ticket 7600. Install the vendor-provided 389-ds update once available and restart dirsrv to load the fixed plugin. Verify the running version with dnf info 389-ds-base or the equivalent package query for your distribution.

Workarounds

Disable the Content Synchronization plugin where the syncrepl protocol is not in active use
Enforce idle and operation timeouts (nsslapd-idletimeout, nsslapd-ioblocktimeout) to terminate stalled sync consumers
Place the directory service behind a network policy that limits authenticated LDAP clients to trusted source ranges

bash

# Example: disable the Content Sync plugin and tighten timeouts via dsconf
dsconf slapd-INSTANCE plugin set "Content Synchronization" --enabled off
dsconf slapd-INSTANCE config replace nsslapd-idletimeout=300
dsconf slapd-INSTANCE config replace nsslapd-ioblocktimeout=10000
systemctl restart dirsrv@INSTANCE