CVE-2026-11789 Overview
CVE-2026-11789 is an integer underflow vulnerability [CWE-191] in the 389 Directory Server. The flaw resides in the SMD5 password storage plugin. The plugin computes the salt length from a user-supplied password hash without validating its size. When a crafted hash shorter than 16 bytes is processed, an unsigned integer underflow produces an oversized length value. The plugin then performs a buffer over-read that crashes the Lightweight Directory Access Protocol (LDAP) server during authentication.
Critical Impact
An authenticated attacker can crash the LDAP service by submitting a malformed SMD5 password hash, disrupting directory services and any dependent authentication workflows.
Affected Products
- 389 Directory Server (Red Hat advisory tracked)
- Red Hat Directory Server distributions consuming the affected pwdstorage plugin
- Downstream identity products embedding 389 Directory Server
Discovery Timeline
- 2026-06-09 - CVE-2026-11789 published to the National Vulnerability Database (NVD)
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-11789
Vulnerability Analysis
The defect is an integer underflow in the SMD5 (Salted MD5) password storage scheme used by 389 Directory Server. SMD5 hashes are stored as a concatenation of a 16-byte MD5 digest followed by a salt. The plugin derives the salt length by subtracting 16 from the decoded hash length. The arithmetic uses an unsigned integer type. When the decoded hash is shorter than 16 bytes, the subtraction wraps to a very large positive value.
The plugin then reads salt bytes using this wrapped length. The read extends past the end of the allocated buffer, triggering an out-of-bounds read. The resulting access violation terminates the ns-slapd process, denying authentication services to all clients bound to that instance.
Root Cause
The root cause is missing bounds validation before the length arithmetic. The plugin assumes the decoded hash always meets or exceeds the 16-byte MD5 digest size. No check enforces decoded_len >= 16 before computing salt_len = decoded_len - 16. The unsigned type masks the underflow, and the oversized length is propagated to downstream memory operations.
Attack Vector
Exploitation requires network access to the LDAP listener and authenticated context with privileges sufficient to trigger an SMD5 comparison. This typically means a user account whose stored credential uses the SMD5 scheme, or an attacker able to influence stored hashes through directory write operations. The attacker submits a bind request or password modify request that causes the SMD5 plugin to parse a malformed hash shorter than 16 bytes. The plugin underflows, reads beyond the buffer, and crashes the daemon.
No verified public proof-of-concept is available. The vulnerability is described in prose only; see the Red Hat CVE-2026-11789 advisory and Red Hat Bug #2485422 for vendor technical details.
Detection Methods for CVE-2026-11789
Indicators of Compromise
- Unexpected termination or restart of the ns-slapd directory server process during or immediately after LDAP bind operations.
- Core dumps referencing the SMD5 password storage plugin (libpwdchan-plugin or smd5_pw_cmp) in the call stack.
- Repeated authentication failures followed by directory service unavailability across LDAP clients.
Detection Strategies
- Inspect 389 Directory Server access and error logs for bind attempts that immediately precede process exits or watchdog-driven restarts.
- Monitor systemd or service manager logs for abnormal exits of dirsrv@<instance>.service correlated with LDAP traffic spikes.
- Audit userPassword attribute values for SMD5-encoded entries with base64 payloads decoding to fewer than 16 bytes.
Monitoring Recommendations
- Alert on repeated ns-slapd crashes within short time windows, as availability impact is the primary signal of exploitation.
- Track LDAP bind error rates and segmentation fault events through host telemetry forwarded to a centralized SIEM.
- Correlate directory service outages with the source IP of preceding bind operations to scope possible abuse.
How to Mitigate CVE-2026-11789
Immediate Actions Required
- Apply vendor-supplied updates for 389 Directory Server as soon as Red Hat publishes fixed packages tracked under Red Hat CVE-2026-11789.
- Restrict LDAP access to trusted management networks while patches are staged, reducing the population of accounts able to trigger the SMD5 code path.
- Audit stored password hashes and migrate any SMD5-encoded credentials to a stronger scheme such as PBKDF2 or Argon2.
Patch Information
No patched version is published in the NVD entry at the time of writing. Track the Red Hat advisory and Red Hat Bug #2485422 for fixed package versions. The expected fix validates decoded hash length before computing salt_len, returning an error when the buffer is shorter than the MD5 digest size.
Workarounds
- Disable the SMD5 password storage plugin if no accounts depend on it, and rehash existing credentials under a supported scheme.
- Apply LDAP access control instructions (ACIs) that limit who can modify userPassword attributes, lowering the risk of attacker-controlled hashes being stored.
- Enable automatic restart of the dirsrv service to reduce downtime if crashes occur before patching completes.
# Restrict the SMD5 plugin via the dsconf utility (example)
dsconf <instance> plugin set "SMD5" --enabled off
dsctl <instance> restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
