Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Identify exposed LDAP service
  2. Delivery
    Induce memory pressure on target host
  3. Exploit
    Send search with dereference control
  4. Install
    Trigger failed BER allocation
  5. C2
    NULL pointer dereference in plugin
  6. Execute
    ns-slapd process crashes
  7. Impact
    Directory service outage

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires network reachability to the 389 Directory Server LDAP/LDAPS listener (typically 389/tcp or 636/tcp) and the ability to send a search request invoking the dereference control plugin, which is enabled by default in 389-ds. The decisive limiting factor is that the NULL dereference only occurs when a BER structure allocation actually fails, i.e., the host is under memory pressure - on a well-provisioned, idle server the bug is not deterministically reachable, though an attacker can attempt to induce pressure via parallel resource-intensive LDAP operations. No authentication, user interaction, or non-default configuration is required.
Impact

Signals are coherent but mixed in priority. CVSS 7.5 reflects a clean AV:N/AC:L/PR:N/UI:N/A:H availability-only profile - remote, unauthenticated, low-complexity crash with no confidentiality or integrity impact. CISA SSVC concurs with a low-urgency posture: Exploitation=none, Automatable=no, Technical Impact=partial, which aligns with EPSS at 0.09% (25th percentile) and the absence of any KEV listing or public POC. The notable caveat is the precondition 'when the system is under memory pressure' - exploitation is not deterministic on a healthy server, which is consistent with the SSVC 'not automatable' rating but means an attacker could compound the bug with parallel memory-exhaustion behavior. Net: a legitimate availability risk for exposed LDAP infrastructure, but not a drop-everything issue - patch on a normal cycle, prioritizing hosts that are internet-exposed or already memory-constrained.
Exploit ScenarioDerived

An unauthenticated attacker with TCP reach to the LDAP listener sends a search request carrying the dereference control while the server is under memory pressure (which the attacker may amplify through concurrent expensive searches or sheer connection volume); a failed BER allocation returns NULL, the plugin dereferences it, and ns-slapd crashes, taking directory authentication and lookup services offline. No public exploit has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jun 12, 2026

Remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13 and Red Hat Enterprise Linux 6 through 10) allows unauthenticated network attackers to crash the LDAP daemon by exploiting an unchecked BER structure allocation in the dereference control plugin when the host is under memory pressure. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.09%, 25th percentile), but the unauthenticated network-reachable nature warrants prompt patching of internet-facing or business-critical directory services.

Earlier versions of this analysis (2)
v2 Jun 12, 2026 - 18:43 cvss changed CVSS 7.5

Remote denial of service in 389 Directory Server (used in Red Hat Directory Server 11-13 and Red Hat Enterprise Linux 6-10) allows unauthenticated attackers to crash the LDAP daemon when the host is under memory pressure. The dereference control plugin fails to check whether a BER structure allocation succeeded before using it, producing a NULL pointer dereference (CWE-476). No public exploit identified at time of analysis and EPSS is low (0.09%), but the network-reachable, no-auth nature of LDAP makes it relevant to availability-sensitive deployments.

v1 Jun 09, 2026 - 13:52 CVSS 5.9

Unauthenticated remote denial-of-service in Red Hat 389 Directory Server allows an attacker to crash the LDAP service by exploiting a NULL pointer dereference in the dereference control plugin. The plugin fails to validate memory allocation success before operating on a BER (Basic Encoding Rules) structure, meaning that under memory-pressured system conditions, a crafted LDAP request triggers a null dereference and terminates the server process. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV; however, LDAP availability is often critical to directory-integrated infrastructure.

RemediationAI

Patch available per vendor advisory - apply the Red Hat-provided 389-ds-base / redhat-ds package update for your platform once the corresponding RHSA is published (track https://access.redhat.com/security/cve/CVE-2026-11788 and Bugzilla 2485423 for the exact fixed version, which was not included in the input data). As a compensating control until patched, restrict LDAP (389/tcp) and LDAPS (636/tcp) network access to known client subnets via host or perimeter firewall, which limits the attack surface but breaks any directory client outside the allowlist. You can also disable the dereference control plugin in dse.ldif (nsslapd-pluginEnabled: off for the deref plugin) to remove the vulnerable code path; the trade-off is that any application relying on the LDAP dereference control will lose that functionality. Finally, ensure adequate memory headroom and monitoring on directory hosts, since the bug only triggers under allocation failure - sustained free memory materially reduces realistic exploitability.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

389 Directory Server is the upstream open-source LDAP/directory implementation shipped by Red Hat as Red Hat Directory Server and bundled into RHEL. The dereference control is an LDAP v3 control (OID 1.3.6.1.4.1.4203.666.5.16) that lets clients request the server resolve DN-valued attributes during a search; the server uses ASN.1 BER (Basic Encoding Rules) structures from libldap/OpenLDAP to parse and build these control payloads. The root cause is CWE-476 NULL Pointer Dereference: when memory allocation for the BER structure fails (e.g., under memory pressure), the plugin does not check the returned pointer and proceeds to dereference it, causing the ns-slapd process to segfault and terminate the LDAP service.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.9 MEDIUM

Network-reachable and unauthenticated, but exploitation depends on inducing a memory-allocation failure in the server, so AC:H; impact is availability-only crash of ns-slapd.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.9 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jun 12, 2026 - 18:43 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 12, 2026 - 18:43 vuln.today
v2 - CVSS changed
Severity Changed
Jun 12, 2026 - 18:37 NVD
MEDIUM HIGH
CVSS changed
Jun 12, 2026 - 18:37 NVD
5.9 (MEDIUM) 7.5 (HIGH)
Severity Changed
Jun 12, 2026 - 18:37 NVD
MEDIUM HIGH
CVSS changed
Jun 12, 2026 - 18:37 NVD
5.9 (MEDIUM) 7.5 (HIGH)
CVE Published
Jun 09, 2026 - 13:02 nvd
MEDIUM 5.9

DescriptionNVD

A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.

Executive ViewAI

Why It Matters

Red Hat Directory Server (versions 11, 12, 13) and RHEL 6-10 are vulnerable to remote denial of service attacks initiated by unauthenticated network actors, risking disruption of critical authentication and identity services that business operations depend on. Organizations with internet-facing or business-critical directory infrastructure face heightened risk of service outages until vendor patches are released. Leadership should prioritize mitigation and inventory of affected systems to preserve operational continuity.

Business Impact: High
Compensating Controls

Implement network segmentation and firewall rules to restrict LDAP access to trusted sources only; enable resource limits (memory, connection pooling) on directory service daemons to reduce denial-of-service impact; deploy network-based rate limiting on LDAP service ports; establish comprehensive monitoring and alerting for daemon restarts, connection anomalies, and memory pressure conditions. Maintain active vendor patch monitoring to deploy fixes immediately upon release.

Threat Intelligence Overview

EPSS Score
0.1%
Top 75% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)NVD

cpe:2.3:a:red_hat:red_hat_directory_server_11:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_directory_server_12:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_directory_server_13:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

Related Vulnerabilities in 389 Directory Server Memory and Input Handling Flaws

View all 8
CVE-2026-11785 MEDIUM
4.3
CVE-2026-11786 MEDIUM
6.5
CVE-2026-11787 MEDIUM
6.3
CVE-2026-11790 MEDIUM
4.9
CVE-2026-11792 LOW
3.3
CVE-2026-11789 MEDIUM
6.5
CVE-2026-11793 MEDIUM
4.9

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-11788 ADVISORY https://vuldb.com/vuln/369539 REF https://access.redhat.com/errata/RHSA-2026:55421 REF https://access.redhat.com/errata/RHSA-2026:55422 REF https://access.redhat.com/errata/RHSA-2026:55423 REF https://access.redhat.com/errata/RHSA-2026:55424 REF https://access.redhat.com/errata/RHSA-2026:55425 REF https://access.redhat.com/errata/RHSA-2026:55426 REF https://access.redhat.com/errata/RHSA-2026:55530 REF https://access.redhat.com/errata/RHSA-2026:55532 REF https://access.redhat.com/errata/RHSA-2026:55756 REF https://access.redhat.com/errata/RHSA-2026:55757 REF https://access.redhat.com/errata/RHSA-2026:55758 REF https://access.redhat.com/errata/RHSA-2026:55794 REF https://access.redhat.com/errata/RHSA-2026:56047 REF https://access.redhat.com/errata/RHSA-2026:56048 REF https://access.redhat.com/errata/RHSA-2026:56050 REF https://access.redhat.com/errata/RHSA-2026:79217 REF https://access.redhat.com/security/cve/CVE-2026-11788 REF https://bugzilla.redhat.com/show_bug.cgi?id=2485423 REF https://redhat.atlassian.net/browse/PSIRTSUPT-7600

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy