Skip to main content

389 Directory Server CVE-2026-11785

| EUVDEUVD-2026-35418 MEDIUM
Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)
2026-06-09 redhat GHSA-8v22-4r9h-6m6j
Information Disclosure Memory Corruption Red Hat Directory Server 11 Red Hat Directory Server 12 Red Hat Directory Server 13 Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9
4.3
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
SUSE
MEDIUM
qualitative
Red Hat
4.3 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Jun 09, 2026 - 13:54 vuln.today
CVE Published
Jun 09, 2026 - 12:57 nvd
MEDIUM 4.3

DescriptionCVE.org

A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users.

AnalysisAI

Partial stack address disclosure in Red Hat 389 Directory Server (versions 11, 12, and 13) allows authenticated remote users to extract memory layout information via crafted LDAP extended operation requests. The root cause is a CWE-843 type confusion in the SSO token extended operation handler, which causes stack pointer data to bleed into LDAP response payloads. While the direct impact is limited to low-confidence information disclosure, leaked stack addresses are a classic ASLR-weakening primitive that could facilitate chained exploitation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

389 Directory Server (the upstream open-source project shipping as Red Hat Directory Server 11/12/13 and bundled with RHEL 6 through 10 via the corresponding CPE strings) implements LDAP extended operations - protocol-level request/response pairs for vendor-specific features. The SSO token extended operation handler contains a CWE-843 (Type Confusion) defect: the handler allocates or interprets internal data under one type and subsequently accesses it under an incompatible type, causing the LDAP response serialization to inadvertently embed partial stack address values. Because the leaked values originate from the stack, this disclosure can weaken Address Space Layout Randomization (ASLR), a key exploit-mitigation technique. The tags 'Information Disclosure' and 'Memory Corruption' both appear, suggesting the type confusion also produces undefined memory state internally, even if only the information leak is currently demonstrated.

RemediationAI

No vendor-released patch version was identified in the available intelligence at time of analysis; patch status should be confirmed against the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-11785 and the internal tracking ticket at https://redhat.atlassian.net/browse/PSIRTSUPT-7600. Until a patch is applied, administrators can reduce exposure by restricting LDAP access to the SSO token extended operation (OID-level ACIs in 389-ds can be configured to deny specific extended operation requests to untrusted accounts, limiting who can trigger the vulnerable handler). Additionally, enforcing strong authentication requirements for LDAP binds (e.g., requiring certificate-based or SASL GSSAPI bind rather than simple bind) raises the bar for the PR:L prerequisite. If 389-ds is not required to be Internet-facing, restricting TCP port 389/636 access to known management subnets via firewall rules eliminates the AV:N vector entirely with no service degradation for internal users. Note that the 'Memory Corruption' tag warrants monitoring the Red Hat advisory for a severity upgrade if a more exploitable variant is confirmed.

More in Red Hat Directory Server 11

View all
CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
CVE-2026-11774 HIGH
7.6 Jun 11

Heap buffer overflow in 389 Directory Server (389-ds-base) SASL I/O layer allows authenticated remote attackers to crash
CVE-2026-11770 HIGH
7.5 Jul 31

Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) le
CVE-2026-11788 HIGH
7.5 Jun 09

Remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13 and Red Hat Enterprise Linux 6 throu
CVE-2026-15722 HIGH
7.5 Jul 31

Remote unauthenticated denial of service in 389 Directory Server (389-ds-base, shipped as Red Hat Directory Server 11-13
CVE-2026-11789 MEDIUM
6.5 Jun 09

Denial-of-service in Red Hat's 389 Directory Server allows a highly privileged network attacker to crash the LDAP servic
CVE-2026-11884 MEDIUM
6.5 Jun 10

Heap buffer overflow in Red Hat 389 Directory Server allows an authenticated Directory Manager or a compromised replicat
CVE-2026-11611 MEDIUM
6.5 Jun 08

Denial of service in Red Hat 389 Directory Server's Content Synchronization persistent search plugin enables authenticat
CVE-2026-11786 MEDIUM
6.5 Jun 09

Out-of-bounds read in 389 Directory Server's LDIF parser exposes limited heap memory to a highly privileged local attack
CVE-2026-11787 MEDIUM
6.3 Jun 09

Heap buffer over-read in Red Hat Directory Server's ldap_utf8prev() function exposes LDAP deployments to potential confi
CVE-2026-12528 MEDIUM
5.4 Jun 17

Heap buffer overflow in 389 Directory Server's ACI parsing layer allows an authenticated LDAP user with write access to

CVE-2026-14940 MEDIUM
5.3 Jul 07

Heap-buffer-overflow in 389 Directory Server's DN normalization routine allows an unauthenticated remote attacker to cor

Same weakness CWE-843 – Access of Resource Using Incompatible Type (Type Confusion)

View all
CVE-2011-0611 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2017-8291 HIGH POC
7.8
CVE-2016-7201 HIGH POC
8.8
CVE-2017-0037 HIGH POC
8.1
CVE-2017-5070 HIGH POC
8.8
CVE-2025-30397 HIGH POC
7.5
CVE-2016-0985 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2023-4966 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected

Share

CVE-2026-11785 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy