PT-2026-47782 · Unknown · 389 Directory Server

Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-11793

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions 389 Directory Server (affected versions not specified)

Description A stack buffer overflow exists in the checkPrefix() function within pw.c. The issue occurs when parsing reversible-encrypted attribute values, as an attacker-controlled algorithm ID is copied into a 256-byte stack buffer without proper bounds checking. An attacker with Directory Manager privileges can cause a denial of service by crashing the LDAP server through the storage of a crafted credential containing an oversized algorithm ID. The use of FORTIFY SOURCE limits the impact to a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-11793

Affected Products

389 Directory Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-11793 · Security Note
• https://twitter.com/VulmonFeeds/status/2064400281480151252 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2484914 · Note
• https://access.redhat.com/security/cve/CVE-2026-11793 · Note
• https://redhat.atlassian.net/browse/PSIRTSUPT-7600 · Note