CVE-2026-11785Medium· 4.3▾ SunlitA flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users.
redhat-ds:11/389-ds-baseredhat-ds:12/389-ds-base (all versions)389-ds-base (all versions)389-ds-base (all versions)389-ds-base389-ds-base389-ds-base389-ds-base (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Option 1 (Recommended): Disable the SSO token feature entirely: dsconf <instance> config replace nsslapd-enable-ldapssotoken=off. This prevents the vulnerable code path from being reached but disables SSO token functionality for all users. Option 2: Restrict network access to LDAP ports (389/636) to trusted networks via firewall rules. Note: Removing the SSO token secret from configuration does not mitigate the vulnerability — the server auto-generates a new secret at startup.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-18663Medium· 5.9389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking control
CVE-2026-16560Medium· 5.3389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued rdn
CVE-2026-14969Medium· 4.4389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption
CVE-2026-14940Medium· 5.3389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn
CVE-2026-11884Medium· 6.5389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation
CVE-2026-11789Medium· 4.9389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash