CVE-2026-11611Medium· 6.5▾ SunlitA flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses, enabling denial of service. Additional race conditio…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses, enabling denial of service. Additional race conditions in plugin thread lifecycle can cause crashes during connection teardown or shutdown.
redhat-ds:11/389-ds-base (all versions)redhat-ds:12/389-ds-base (all versions)389-ds-base (all versions)389-ds-base (all versions)389-ds-base389-ds-base (all versions)389-ds-base (all versions)389-ds-base (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Bug 1 (Queue DoS): Reduce SYNC_MAX_CONCURRENT from the default of 10 to minimize the number of clients that can accumulate queues. Apply network-level rate limiting on persistent sync search requests. Monitor client connections and terminate stalled sync clients that stop reading for an extended period. Set system-level memory limits (e.g., LimitAS= in the systemd unit file or cgroup memory limits) to prevent unbounded memory growth. Bugs 2 and 3: No workaround available — these are code-level race conditions that require source fixes.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-11790Medium· 4.9389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service
CVE-2026-107123High· 7.5Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing
CVE-2026-18663Medium· 5.9389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking control
CVE-2026-16560Medium· 5.3389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued rdn
CVE-2026-110932High· 7.5Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cache
CVE-2026-82965High· 7.5Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing