CVE-2026-11884 Overview
CVE-2026-11884 is a heap buffer overflow vulnerability in the 389 Directory Server, an enterprise Lightweight Directory Access Protocol (LDAP) implementation. The flaw resides in the schema serialization logic, where the oc_superior (SUP) field length is omitted from buffer size calculations in read_schema_dse() and schema_oc_to_string(). The field is still written via strcat(), producing an out-of-bounds heap write. An attacker holding Directory Manager privileges, or controlling a compromised replication supplier, can crash the server by submitting objectclass definitions with long SUP values. This issue is an incomplete fix variant of CVE-2025-14905 and is classified under [CWE-122].
Critical Impact
Authenticated attackers can trigger a heap buffer overflow that crashes the 389 Directory Server, disrupting LDAP services across the directory infrastructure.
Affected Products
- 389 Directory Server (upstream project)
- Red Hat Directory Server distributions tracking the affected schema serialization code
- Downstream Linux distributions packaging vulnerable 389-ds-base builds
Discovery Timeline
- 2026-06-10 - CVE-2026-11884 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-11884
Vulnerability Analysis
The vulnerability affects how 389 Directory Server serializes objectclass definitions back into the schema Directory Server Entry (DSE). When the server allocates the destination buffer, the length of the oc_superior (SUP) field is excluded from the size calculation. The serialization routine then appends the SUP value using strcat(), writing past the end of the allocated heap buffer.
The affected code paths are read_schema_dse() and schema_oc_to_string(). Both functions participate in reading, normalizing, and emitting schema entries during schema modifications, replication updates, and DSE reloads. Because the overflow lands on the heap, it corrupts adjacent allocator metadata and process memory, causing the ns-slapd process to terminate.
This flaw is an incomplete fix variant of CVE-2025-14905. The earlier remediation closed related size-calculation errors but did not account for the SUP attribute in these specific serialization paths.
Root Cause
The root cause is a size-calculation mismatch between buffer allocation and buffer writes. Allocation logic computes the required length using only a subset of objectclass fields, while the writer concatenates every field, including SUP, through strcat(). Long SUP values therefore exceed the allocated capacity, producing a classic heap buffer overflow [CWE-122].
Attack Vector
The attack vector is network-based but requires high privileges. An attacker authenticated as Directory Manager can submit a crafted objectclass definition with an overlong SUP value through normal schema modification operations. Alternatively, an attacker who compromises a replication supplier can propagate the malicious schema entry to consumers, triggering the overflow during schema serialization. Successful exploitation results in process termination and denial of service for LDAP-dependent applications.
No verified public proof-of-concept code is available. Refer to the Red Hat CVE-2026-11884 Advisory and the Red Hat Bugzilla Report #2484913 for upstream technical details.
Detection Methods for CVE-2026-11884
Indicators of Compromise
- Unexpected termination or repeated restarts of the ns-slapd process accompanied by heap corruption signatures in system logs or core dumps.
- Schema modification operations from privileged accounts that introduce objectclass entries with abnormally long SUP values.
- Replication events from suppliers delivering schema updates containing oversized SUP attributes immediately preceding consumer crashes.
Detection Strategies
- Audit 389 Directory Server access logs for MOD operations targeting cn=schema with unusually long attribute values.
- Correlate ns-slapd segmentation faults or SIGABRT events with the most recent schema modification or replication update.
- Monitor systemd journal entries and abrt reports for repeated 389-ds-base crashes following directory write activity.
Monitoring Recommendations
- Forward 389 Directory Server access, error, and audit logs to a central analytics platform and alert on schema modifications outside change windows.
- Track replication topology health and flag consumer crashes that occur during schema replication cycles.
- Baseline normal schema attribute lengths and alert when SUP values significantly exceed the established norms.
How to Mitigate CVE-2026-11884
Immediate Actions Required
- Apply vendor-provided 389-ds-base updates as soon as patched packages are available from your distribution.
- Restrict Directory Manager credentials to a minimal set of administrators and rotate any credentials with broad write access.
- Audit replication agreements and verify that supplier servers are fully patched and access-restricted.
Patch Information
Consult the Red Hat CVE-2026-11884 Advisory for fixed package versions and errata identifiers. Tracking bugs are available in Red Hat Bugzilla Report #2423624 and Red Hat Bugzilla Report #2484913. Internal coordination is tracked in Red Hat PSIRT Ticket #7600.
Workarounds
- Limit network exposure of the LDAP service to trusted management networks while updates are scheduled.
- Enforce strict Access Control Instructions (ACIs) that prevent non-administrative accounts from modifying cn=schema.
- Disable or temporarily quarantine replication agreements with suppliers that cannot be patched promptly.
# Configuration example
# Restrict schema modifications to a single Directory Manager bind DN via ACI review
ldapsearch -D "cn=Directory Manager" -W -b "cn=schema" "(objectClass=*)" aci
# Confirm the running 389-ds-base version against the vendor advisory
rpm -q 389-ds-base
systemctl status dirsrv@<instance>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
