CVE-2026-11793CWE-121

CVE-2026-11793

Medium · published June 9, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
19.6
In the wild
Unconfirmed
What it is

A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix() function in pw.c copies an attacker-controlled algorithm ID into a 256-byte stack buffer without bounds checking when parsing reversible-encrypted attribute values. An attacker with Directory Manager privileges can crash the LDAP server by storing a crafted credential with an oversized algorithm ID. FORTIFY_SOURCE mitigates this to denial of service only.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00282 · 19.6th percentile
Weakness
CWE-121 · Stack-based Buffer Overflow
Published
2026-06-09T18:16Z
Affected products (1)
ProductVersionsFixed in
redhat/389_directory_serverall versions—
References (2)
https://access.redhat.com/security/cve/CVE-2026-11793 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2484914 · [email protected]
EPSS history
Timeline
  • 09 JUN 13:11Z
    389-ds-base: 389-ds-base: stack buffer overflow in checkprefix() algorithm id parsing
    cvelistv5