---
id: CVE-2026-11611
title: >-
  389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race
  conditions
summary: >-
  A flaw was found in 389 Directory Server. The Content Synchronization
  persistent search plugin allows unbounded memory growth when an authenticated
  client stops reading sync responses, enabling denial of service. Additional
  race conditio…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-400
vendor: Red Hat
product: 'redhat-ds:11/389-ds-base'
affected:
  - 'redhat-ds:11/389-ds-base (all versions)'
  - 'redhat-ds:12/389-ds-base (all versions)'
  - 389-ds-base (all versions)
  - 389-ds-base (all versions)
  - 389-ds-base
  - 389-ds-base (all versions)
  - 389-ds-base (all versions)
  - 389-ds-base (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-09T14:28:50.963949Z'
published: '2026-06-08'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T16:22:24.880Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-11611'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-11611'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2485424'
    label: RHBZ#2485424
tags:
  - cve.org
epss: 0.00244
epssPercentile: 0.15665
ingestedAt: '2026-11-05T22:38:31.340Z'
---

## Overview

A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses, enabling denial of service. Additional race conditions in plugin thread lifecycle can cause crashes during connection teardown or shutdown.

## Affected

- `redhat-ds:11/389-ds-base (all versions)`
- `redhat-ds:12/389-ds-base (all versions)`
- `389-ds-base (all versions)`
- `389-ds-base (all versions)`
- `389-ds-base`
- `389-ds-base (all versions)`
- `389-ds-base (all versions)`
- `389-ds-base (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Bug 1 (Queue DoS): Reduce SYNC_MAX_CONCURRENT from the default of 10 to minimize the number of clients that can accumulate queues. Apply network-level rate limiting on persistent sync search requests. Monitor client connections and terminate stalled sync clients that stop reading for an extended period. Set system-level memory limits (e.g., LimitAS= in the systemd unit file or cgroup memory limits) to prevent unbounded memory growth. Bugs 2 and 3: No workaround available — these are code-level race conditions that require source fixes.