5.0 Medium

CVE-2026-11787 389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing

Description

A flaw was found in 389 Directory Server. The ldap_utf8prev() function reads bytes before the start of a buffer without bounds checking, causing a heap buffer over-read in string filter parsing that may influence internal filter processing behavior.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector: Network
Attack complexity: High
Privileges required: Low
Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: Low

Affected products and versions

Product	Affected versions	Fixed in
Red Hat Directory Server 11	Versions not published
Red Hat Directory Server 12	Versions not published
Red Hat Directory Server 13	Versions not published
Red Hat Enterprise Linux 10	Versions not published
Red Hat Enterprise Linux 6	Versions not published
Red Hat Enterprise Linux 7	Versions not published
Red Hat Enterprise Linux 8	Versions not published
Red Hat Enterprise Linux 9	Versions not published

References

access.redhat.com access.redhat.com
RHBZ#2485425 bugzilla.redhat.com

Timeline

Published June 9, 2026
Last modified November 5, 2026

The 42 CVEs of Red Hat Directory Server 11 →

CVE-2026-117548 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service 6.5 Medium CVE-2026-86345 389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result 9.0 Critical CVE-2026-86344 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue 7.5 High CVE-2026-19843 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor 8.4 High

Track this CVE