CVE-2026-11790: 389 Directory Server DOS Vulnerability

CVE-2026-11790 Overview

CVE-2026-11790 affects the 389 Directory Server, an enterprise-class Lightweight Directory Access Protocol (LDAP) server maintained by Red Hat. The flaw resides in the PBKDF2-SHA256 password storage plugin, which fails to enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can trigger excessive CPU consumption during authentication, leading to denial of service [CWE-400].

The vulnerability requires high privileges to exploit but can affect availability across the directory service. The issue is tracked in the Red Hat Bug Report and the Red Hat CVE Advisory.

Critical Impact
A privileged attacker can plant a password hash with an arbitrarily large PBKDF2 iteration count, forcing the directory server to consume excessive CPU resources during each authentication attempt against the affected account.

Affected Products

389 Directory Server (PBKDF2-SHA256 password storage plugin)
Red Hat Directory Server distributions bundling the affected plugin
Downstream LDAP deployments using PBKDF2-SHA256 password storage

Discovery Timeline

2026-06-09 - CVE-2026-11790 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11790

Vulnerability Analysis

The 389 Directory Server supports several password storage schemes, including PBKDF2-SHA256. PBKDF2 (Password-Based Key Derivation Function 2) deliberately runs many hashing iterations to slow brute-force attacks. The iteration count is encoded inside the stored hash value and parsed at authentication time.

The affected plugin reads the iteration count directly from the stored hash without validating an upper bound. When an attacker writes a crafted password hash that specifies an extremely large iteration count, every subsequent bind operation against that account forces the server to perform that many SHA-256 rounds. The work is performed inside the server process, blocking the worker thread and consuming CPU cycles.

Repeated authentication attempts against one or more affected accounts can exhaust CPU resources, degrade response times for legitimate LDAP clients, and ultimately cause denial of service across the directory.

Root Cause

The root cause is missing input validation on the iteration count field parsed from the PBKDF2-SHA256 hash structure. The plugin trusts the stored value and passes it directly to the key derivation routine. There is no maximum-iteration ceiling and no guard against pathological values, which maps to [CWE-400] Uncontrolled Resource Consumption.

Attack Vector

Exploitation requires an authenticated user with privileges to modify a target account's userPassword attribute or write a directly stored hash using the {PBKDF2-SHA256} prefix. After planting the malicious hash, the attacker repeatedly issues LDAP bind requests against the targeted Distinguished Name (DN). Each bind triggers the iteration loop, consuming a server worker thread until the operation completes or times out. Concurrent bind requests amplify the impact across all available worker threads.

No verified public proof-of-concept code is available. The vulnerability mechanism can be reviewed in the Red Hat PSIRT Update.

Detection Methods for CVE-2026-11790

Indicators of Compromise

Stored userPassword values prefixed with {PBKDF2-SHA256} containing unusually large iteration counts compared to the directory's configured default
Sustained high CPU utilization by the ns-slapd process tied to bind operations against specific user DNs
Audit log entries showing modify operations on userPassword attributes followed by repeated BIND attempts against the same DN
LDAP client timeouts and worker-thread saturation reported in access and errors logs

Detection Strategies

Parse userPassword attributes for the PBKDF2-SHA256 scheme and flag iteration counts above the organizationally approved maximum
Correlate password-modify events with subsequent spikes in bind latency from the same source IP or principal
Baseline ns-slapd CPU usage and alert on sustained deviation tied to LDAP bind workloads
Review privileged write activity on directory entries containing password attributes

Monitoring Recommendations

Forward 389 Directory Server access, audit, and errors logs to a centralized SIEM for correlation
Track per-account bind latency and failure rates to surface accounts whose authentication path is unusually expensive
Monitor administrative accounts capable of modifying password hashes and alert on out-of-pattern writes
Generate alerts when LDAP worker-thread pool utilization approaches saturation

How to Mitigate CVE-2026-11790

Immediate Actions Required

Apply vendor updates for 389 Directory Server once available from your distribution; track status through the Red Hat CVE Advisory
Audit all userPassword values using the {PBKDF2-SHA256} scheme and reset any with iteration counts outside the configured range
Restrict the set of accounts authorized to modify password attributes through directory Access Control Instructions (ACIs)
Rotate credentials for any administrative accounts that may have been used to plant malicious hashes

Patch Information

No fixed version was published in the enriched advisory data at the time of writing. Refer to the Red Hat Bug Report and the Red Hat PSIRT Update for the authoritative remediation status and updated package versions.

Workarounds

Limit write access on userPassword attributes to a minimal, monitored set of administrative principals
Enforce LDAP operation time limits (nsslapd-timelimit) and idle timeouts so that pathological bind operations cannot block worker threads indefinitely
Consider temporarily switching the default password storage scheme away from PBKDF2-SHA256 until patched, while keeping protections against weaker schemes in place
Implement rate limiting and connection throttling at the network layer for LDAP bind traffic from untrusted sources

bash

# Example: review accounts using PBKDF2-SHA256 and inspect iteration counts
ldapsearch -LLL -o ldif-wrap=no -D "cn=Directory Manager" -W \
  -b "dc=example,dc=com" "(userPassword=*{PBKDF2-SHA256}*)" userPassword

# Tighten ACIs so only a dedicated role can modify userPassword
dsconf <instance> plugin password-storage-scheme list
dsconf <instance> config replace nsslapd-timelimit=30