389-ds-base EUVD-2026-112637

Requires an authenticated LDAP bind plus an access control instruction granting the attacker ModifyDN (rename/modrdn) permission on the target entry; the attacker must then perform a rename whose new RDN specifies an attribute by a schema alias name (e.g. 'commonName') rather than its canonical name (e.g. 'cn'). Limiting factors: valid credentials and an explicit modrdn ACI on an entry are both needed (PR:L), so anonymous or ordinary read-only users cannot trigger it; impact is limited to availability (server crash/DoS) with no data disclosure or modification. This affects Red Hat Directory Server 11/12/13 and the 389-ds-base shipped in Red Hat Enterprise Linux 6-10 per the supplied CPEs.

The signals point to a genuine but moderate-priority availability issue rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) indicates a network-reachable, low-complexity attack with no user interaction and pure availability impact (no confidentiality or integrity loss), but it explicitly requires low privileges (PR:L) - the attacker must already be an authenticated LDAP user holding ModifyDN/rename permission on the target entry, which meaningfully narrows the realistic attacker population. There is no KEV listing, so exploitation status is: no public exploit identified at time of analysis; the only references are the Red Hat CVE page and a Bugzilla tracker, neither of which is PoC or exploit code. No EPSS score is present in the input, so probabilistic exploitation likelihood cannot be quantified. The vuln.today decision label is 'this_month', consistent with a reproducible authenticated DoS that should be remediated on a normal patch cadence rather than treated as act_now/emergency. No SSVC exploitation/automatable/technical-impact decision values were supplied. Net: a credible, easily triggered crash for someone who already has rename rights, but the privilege prerequisite and the absence of KEV/PoC/EPSS keep real-world urgency moderate.

An authenticated directory user who has been granted ModifyDN (rename) rights on at least one entry issues a rename (modrdn) operation whose new relative distinguished name uses a schema attribute alias such as 'commonName' instead of the canonical attribute name 'cn'. The server fails to resolve the alias and dereferences a NULL pointer, crashing the directory server process and denying service to all clients. No public exploit code is identified at time of analysis, and no user interaction by others is needed.