CVE-2026-11788: 389 Directory Server DoS Vulnerability

CVE-2026-11788 Overview

CVE-2026-11788 is a null pointer dereference vulnerability [CWE-476] in the 389 Directory Server, an enterprise-grade Lightweight Directory Access Protocol (LDAP) server maintained by the 389 Project and shipped by Red Hat. The dereference control plugin fails to verify allocation success before operating on a Basic Encoding Rules (BER) structure. An unauthenticated remote attacker can trigger the flaw when the host is under memory pressure, causing the LDAP server process to crash. The result is a denial-of-service condition affecting directory-dependent authentication, authorization, and identity workflows.

Critical Impact
Unauthenticated remote attackers can crash the 389 Directory Server under memory pressure, disrupting LDAP-backed authentication services across dependent systems.

Affected Products

389 Directory Server (dereference control plugin)
Red Hat Directory Server distributions tracking the upstream component
Downstream Linux distributions packaging 389-ds-base

Discovery Timeline

2026-06-09 - CVE-2026-11788 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11788

Vulnerability Analysis

The defect lives in the dereference control plugin of 389 Directory Server. The plugin handles the LDAP dereference control, which lets clients request that the server return attributes from entries referenced by DN-valued attributes. During request handling, the plugin allocates a BER structure used to encode the response. The code path uses this structure without confirming that the allocation returned a valid pointer.

Under normal conditions, the allocation succeeds and the request proceeds. When the host is under memory pressure, the allocation can fail and return a null pointer. The subsequent dereference operates on that null pointer, terminating the ns-slapd process and severing all active LDAP sessions. The flaw is reachable without authentication because the dereference control can be supplied on operations available to anonymous binds.

Root Cause

The root cause is a missing return-value check on a memory allocation routine that produces the BER working buffer inside the dereference control plugin. The code assumes the pointer is always valid and proceeds directly to a field access or function call that dereferences it. This pattern matches [CWE-476: NULL Pointer Dereference].

Attack Vector

Attack delivery is network-based. An attacker sends a crafted LDAP request that includes the dereference control to a reachable 389 Directory Server instance. The attacker does not need credentials. Successful exploitation requires the server to be in a low-memory state at the moment the request is processed, which raises attack complexity. Repeated probing during periods of high server load increases the likelihood of triggering the condition. See the Red Hat CVE-2026-11788 advisory for vendor analysis.

Detection Methods for CVE-2026-11788

Indicators of Compromise

Unexpected termination of the ns-slapd process with crash signatures in /var/log/dirsrv/slapd-<instance>/errors
Core dumps referencing the dereference control plugin or BER encoding routines
Spikes in LDAP requests carrying the dereference control object identifier 1.3.6.1.4.1.4203.666.5.16
Authentication failures in dependent applications coinciding with directory server restarts

Detection Strategies

Monitor systemd and service manager logs for repeated dirsrv@<instance>.service restarts
Inspect LDAP access logs for anonymous searches containing the dereference control near the time of crashes
Correlate host memory utilization metrics with directory service availability gaps
Enable verbose plugin logging during incident triage to confirm the dereference control code path executed before termination

Monitoring Recommendations

Track free memory, swap usage, and oom-killer events on directory server hosts
Alert on ns-slapd process restarts and abnormal exit codes through host telemetry
Forward LDAP audit logs to a central analytics platform and baseline use of LDAP controls
Apply file integrity monitoring to 389-ds binaries and plugin libraries to detect tampering during recovery windows

How to Mitigate CVE-2026-11788

Immediate Actions Required

Apply vendor updates for 389-ds-base as soon as packages are released by your distribution
Restrict network reachability of LDAP ports 389/tcp and 636/tcp to known clients using host or network firewalls
Provision sufficient memory and configure resource limits to reduce the window in which allocations fail
Disable anonymous binds where business processes permit, reducing the pool of unauthenticated callers

Patch Information

Red Hat is tracking the issue under Red Hat Bug Report #2485423 and Red Hat PSIRT Task #7600. Consult the Red Hat CVE-2026-11788 page for fixed package versions and errata identifiers for each supported product stream. Apply updates to all replicas in a topology and restart dirsrv instances in a controlled order to preserve replication state.

Workarounds

Disable the dereference control plugin if it is not required by client applications
Place the directory service behind an LDAP-aware proxy that strips unsupported or unused controls from inbound requests
Enable automated service recovery using systemd Restart directives to shorten downtime while patches are staged
Increase host memory headroom and tune nsslapd-cachememsize to limit conditions that produce allocation failures

bash

# Example: list and disable the dereference plugin on a 389 DS instance
dsconf <instance> plugin list | grep -i deref
dsconf <instance> plugin set "deref" --enabled off
dsctl <instance> restart