PT-2026-47779 · Unknown · 389 Directory Server

Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-11789

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions 389 Directory Server (affected versions not specified)

Description A flaw in the SMD5 password storage plugin allows an unsigned integer underflow when calculating the salt length from a crafted password hash shorter than 16 bytes. This leads to a buffer over-read, which causes the LDAP server to crash during the authentication process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2026-11789

Affected Products

389 Directory Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-11789 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-11789 · Note
• https://twitter.com/VulmonFeeds/status/2064397721436319806 · Twitter Post
• https://redhat.atlassian.net/browse/PSIRTSUPT-7600 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2485422 · Note