CVE-2026-117548: 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service
A flaw was found in 389-ds-base. When processing a ModifyDN (rename) request whose new relative distinguished name (RDN) uses an attribute's schema alias name (for example, "commonName") instead of its canonical name (for example, "cn"), the server fails to recognize that the aliased attribute already exists on the target entry. This causes the directory server to construct a duplicate, inconsistent internal attribute structure for the entry. A subsequent internal lookup against this inconsistent structure dereferences a NULL pointer, crashing the ns-slapd process. An authenticated user holding the "moddn" (rename) access control right on an entry can use this flaw to crash the directory server, resulting in a denial of service for all users of that directory server instance.
Other sources
A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as "commonName") instead of its canonical name (such as "cn") as the new relative distinguished name. An authenticated attacker with the ModifyDN (rename) permission on the affected entry can use this flaw to crash the directory server, causing a denial of service.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user must have the "moddn" (rename) access-control right on the affected entry. The issue can be triggered remotely through a ModifyDN request.
What request pattern triggers the crash?
The new RDN in a ModifyDN request must use a schema alias for an attribute rather than that attribute's canonical name, such as using "commonName" instead of "cn." This can create an inconsistent duplicate internal attribute structure and subsequently crash ns-slapd.
What is the impact on the directory service?
Successful exploitation crashes the ns-slapd process, causing denial of service for all users of the affected directory server instance.