CVE-2026-11793

{
  "id": "CVE-2026-11793",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-09T14:16:37.503",
  "lastModified": "2026-11-06T18:17:58.873",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix() function in pw.c copies an attacker-controlled algorithm ID into a 256-byte stack buffer without bounds checking when parsing reversible-encrypted attribute values. An attacker with Directory Manager privileges can crash the LDAP server by storing a crafted credential with an oversized algorithm ID. FORTIFY_SOURCE mitigates this to denial of service only."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad de desbordamiento de búfer en la pila en 389 Directory Server. La función checkPrefix() en pw.c copia un ID de algoritmo controlado por el atacante en un búfer de pila de 256 bytes sin verificación de límites al analizar valores de atributo cifrados de forma reversible. Un atacante con privilegios de Directory Manager puede provocar la caída del servidor LDAP al almacenar una credencial especialmente diseñada con un ID de algoritmo sobredimensionado. FORTIFY_SOURCE mitiga esto solo a denegación de servicio."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat Directory Server 11",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "redhat-ds:11/389-ds-base",
          "cpes": [
            "cpe:/a:redhat:directory_server:11"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Directory Server 12",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "redhat-ds:12/389-ds-base",
          "cpes": [
            "cpe:/a:redhat:directory_server:12"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Directory Server 13",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "389-ds-base",
          "cpes": [
            "cpe:/a:redhat:directory_server:13"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "389-ds-base",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:10"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 6",
          "defaultStatus": "unknown",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "389-ds-base",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 7",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "389-ds-base",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "389-ds-base",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "389-ds-base",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 4.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-09T13:29:17.306116Z",
          "id": "CVE-2026-11793",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:redhat:389_directory_server:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A861110D-0BBC-4052-BBFD-F718F6CD72C5"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-11793",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484914",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ]
    }
  ]
}