CVE-2026-11792 Overview
CVE-2026-11792 is a heap buffer overflow vulnerability in the 389 Directory Server, an enterprise-class Lightweight Directory Access Protocol (LDAP) server. The flaw resides in the create_masked_entry_string() function within auditlog.c. When audit logging is enabled, the function copies a fixed-length password mask into a precisely-sized heap buffer without validating available space. A short cleartext password entry written to the audit log overflows the destination buffer, corrupting adjacent heap memory and audit output. Exploitation requires non-default CLEAR password storage or a compromised replication peer, limiting practical attack scenarios.
Critical Impact
Heap memory corruption in the directory server's audit logging path can degrade integrity and availability of the LDAP service when CLEAR password storage or compromised replication is in play.
Affected Products
- 389 Directory Server (audit logging component)
- Red Hat Directory Server distributions referencing RHBA-2025:15534
- Deployments using CLEAR password storage or replication topologies with untrusted peers
Discovery Timeline
- 2026-06-09 - CVE-2026-11792 published to the National Vulnerability Database (NVD)
- 2026-06-09 - Last updated in the NVD database
Technical Details for CVE-2026-11792
Vulnerability Analysis
The defect is a classic heap-based buffer overflow [CWE-122] in the audit logging subsystem of 389 Directory Server. The create_masked_entry_string() routine allocates a heap buffer sized to the length of the value being logged. It then copies a fixed-length password mask string into that buffer. When the original cleartext password is shorter than the mask, the copy writes beyond the allocated boundary. The result is corruption of adjacent heap chunks and malformed audit log records. Because corruption occurs inside slapd, the directory server process, availability and integrity of the LDAP service are at risk.
Root Cause
The root cause is a missing length check between the source mask string and the destination heap allocation in auditlog.c. The allocator sizes the buffer using the cleartext password length rather than the larger mask length. The unchecked memcpy-style operation writes the full mask, overrunning the buffer when the password is shorter than the mask.
Attack Vector
The attack requires audit logging to be enabled and one of two preconditions: CLEAR password storage configured for accounts, or a compromised replication peer that can inject short cleartext password values. An authenticated, high-privileged actor or a malicious replica supplier triggers the logging path by performing an add or modify operation containing a short cleartext password. The directory server then corrupts its own heap while writing the audit entry. The complexity of the exploitation path explains the limited severity rating.
No verified public exploit code is available. See the Red Hat Bug Report and the Red Hat CVE Details for upstream technical analysis.
Detection Methods for CVE-2026-11792
Indicators of Compromise
- Malformed or truncated entries in the 389 Directory Server audit log files, particularly around modify operations containing password attributes.
- Unexpected slapd process crashes, segmentation faults, or restarts on directory servers with audit logging enabled.
- Replication errors or anomalous changelog entries originating from peer suppliers using CLEAR password storage.
Detection Strategies
- Review directory server configuration for passwordStorageScheme: CLEAR and flag any deployment using cleartext password storage.
- Correlate slapd crash events with recent LDAP add or modify operations on userPassword attributes.
- Monitor replication peers for unexpected schema, supplier identity, or credential changes that could indicate compromise.
Monitoring Recommendations
- Forward 389 Directory Server access, error, and audit logs to a centralized logging platform for integrity checks and anomaly detection.
- Alert on heap corruption signatures, abort traps, or glibc malloc diagnostics in slapd process output.
- Track service restart counts and uptime metrics on directory infrastructure to surface stability regressions tied to logging activity.
How to Mitigate CVE-2026-11792
Immediate Actions Required
- Apply the vendor-supplied patch referenced in Red Hat Security Errata RHBA-2025:15534 to all 389 Directory Server instances.
- Audit passwordStorageScheme settings and migrate any account using CLEAR storage to a hashed scheme such as PBKDF2-SHA512.
- Validate the integrity and trust of every replication supplier and consumer in the directory topology.
Patch Information
Red Hat has released fixed packages tracked under RHBA-2025:15534. The upstream fix corrects the buffer sizing logic in create_masked_entry_string() so the destination allocation accommodates the full password mask before the copy occurs. Administrators should refer to the Red Hat PSIRT Ticket and the Red Hat CVE advisory for package versions and backport status.
Workarounds
- Disable audit logging temporarily on affected directory servers until the patch is deployed.
- Remove CLEAR from passwordStorageScheme and require hashed password storage for all accounts.
- Restrict replication agreements to authenticated, trusted peers and rotate replication credentials.
# Example: switch 389 Directory Server to a hashed password storage scheme
dsconf <instance> config replace passwordStorageScheme=PBKDF2-SHA512
# Example: temporarily disable the audit log while patching
dsconf <instance> config replace nsslapd-auditlog-logging-enabled=off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
