4.3 Medium

CVE-2026-11785 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handler

Description

A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector: Network
Attack complexity: Low
Privileges required: Low
Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
Red Hat Directory Server 11	Versions not published
Red Hat Directory Server 12	Versions not published
Red Hat Directory Server 13	Versions not published
Red Hat Enterprise Linux 10	Versions not published
Red Hat Enterprise Linux 6	Versions not published
Red Hat Enterprise Linux 7	Versions not published
Red Hat Enterprise Linux 8	Versions not published
Red Hat Enterprise Linux 9	Versions not published

References

access.redhat.com access.redhat.com
RHBZ#2485427 bugzilla.redhat.com

Timeline

Published June 9, 2026
Last modified November 5, 2026

The 42 CVEs of Red Hat Directory Server 11 →

CVE-2026-117548 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service 6.5 Medium CVE-2026-86345 389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result 9.0 Critical CVE-2026-86344 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue 7.5 High CVE-2026-19843 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor 8.4 High

Track this CVE