389 Directory Server CVE-2026-11611

Exploitation of the memory exhaustion path requires: (1) valid LDAP credentials sufficient to bind to the directory server (confirmed by CVSS PR:L - low-privilege authenticated access), (2) network connectivity to the LDAP service port (389/636), and (3) the Content Synchronization plugin to be active, which is enabled by default in 389 Directory Server deployments. No administrative or elevated directory privileges are required beyond a standard bind. The race condition crash path may trigger without deliberate attacker action - it surfaces during connection teardown or server shutdown under concurrent plugin activity, meaning it can be triggered incidentally by any authenticated client that disconnects while a sync is in progress. Factors limiting exploitation: anonymous or unauthenticated access is insufficient (PR:N would be required for that); the attack is confined to availability impact with no credential disclosure or data manipulation possible; and environments that have disabled the Content Synchronization plugin or blocked persistent search via ACIs are not affected by the memory exhaustion vector.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H scores 6.5 (Medium), accurately reflecting a network-reachable, low-complexity denial-of-service with no confidentiality or integrity impact. The PR:L (low privileges) requirement is significant: exploitation is gated behind valid LDAP credentials, which limits exposure compared to unauthenticated DoS paths. However, in many enterprise deployments 389 DS is queried by a broad population of authenticated users or service accounts, making the credential barrier a weak deterrent in practice. Attack complexity is genuinely low - no special timing, crafted packets, or system knowledge beyond the ability to open a persistent search and cease reading is required. No EPSS score was provided in available data, preventing probabilistic exploitation comparison. No public exploit code exists at time of analysis, and this CVE does not appear in CISA KEV, indicating no confirmed active exploitation. The race condition crash path introduces an additional availability risk that is harder to trigger intentionally but may manifest under normal load during rolling restarts or connection churn, lowering the effective bar for impact beyond intentional attack scenarios. Overall: a genuine medium-priority availability risk for organizations treating directory server uptime as critical infrastructure.

An attacker with valid LDAP credentials - or an insider with any directory-bound service account - connects to the 389 Directory Server and issues an LDAP Extended Operation for Content Synchronization persistent search. The client then deliberately stalls, ceasing to read returned sync entries. The server buffers an ever-growing backlog of pending sync responses, consuming heap memory continuously until the server process is killed by the OS OOM killer or becomes unresponsive, denying directory services to all dependent applications. No public exploit code exists at time of analysis, but the technique is trivially reproducible using standard LDAP tooling.