CVE-2026-11787Medium· 5.0▾ SunlitA flaw was found in 389 Directory Server. The ldap_utf8prev() function reads bytes before the start of a buffer without bounds checking, causing a heap buffer over-read in string filter parsing that may influence internal filter processi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
A flaw was found in 389 Directory Server. The ldap_utf8prev() function reads bytes before the start of a buffer without bounds checking, causing a heap buffer over-read in string filter parsing that may influence internal filter processing behavior.
redhat-ds:11/389-ds-base (all versions)redhat-ds:12/389-ds-base (all versions)389-ds-base (all versions)389-ds-base (all versions)389-ds-base389-ds-base (all versions)389-ds-base (all versions)389-ds-base (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
No direct workaround addresses the code-level bug; network-level mitigations (proxies, WAFs, filter validation) do not apply. Mitigation measures to reduce exposure: restrict plugin configuration access (MEP originFilter, UID uniqueness nsUniqueAttribute, strict ACIs on cn=config); restrict Directory Manager access for ACI, MEP, or uniqueness plugin configuration; harden replication topology to restrict replication peers; monitor for anomalous search result sets that may indicate exploitation.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-18663Medium· 5.9389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking control
CVE-2026-16560Medium· 5.3389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued rdn
CVE-2026-14969Medium· 4.4389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption
CVE-2026-14940Medium· 5.3389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn
CVE-2026-11884Medium· 6.5389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation
CVE-2026-11789Medium· 4.9389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash