CVE-2026-11785: 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handler
A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users.
Other sources
A type confusion bug in extophandleldapssotokenrequest() (extendop.c) passes a stack pointer (&rc) to berprintf with format 'i' which expects an integer. The low 32 bits of a stack address are encoded into every SSO token LDAP extended operation response.
Any authenticated non-administrator user can extract partial stack address information. SSO token feature enabled by default with auto-generated secret (Issue #1797). PoC confirmed on Fedora 42: INTEGER=0x8e7faed8 leaked. Reduces stack ASLR entropy but is not a full bypass.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the SSO token feature so that the LDAP extended operation response no longer includes partial stack address information encoded from SSO tokens.
389 Directory Server (SSO token extended operation / SSO token feature) SSO token feature (enabled by default) = disabled - Compensating control
Limit access to LDAP extended operations used for SSO tokens so that only authorized administrators can call them, reducing exposure to any authenticated non-administrator user who can extract partial stack address information.
- Operational
Because the SSO token feature uses an auto-generated secret (Issue #1797), rotate/re-generate the SSO token secret after disabling or remediating the feature to ensure any previously generated/known token materials are invalidated.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11785?
CVE-2026-11785 has a medium severity rating of 4.3.
What vulnerability does CVE-2026-11785 describe?
CVE-2026-11785 describes a partial stack address information leak due to type confusion in the SSO token handler of 389 Directory Server.
How do I fix CVE-2026-11785?
To fix CVE-2026-11785, update the 389 Directory Server to the latest patched version provided by Red Hat.
Who is affected by CVE-2026-11785?
Authenticated users of the 389 Directory Server may be affected by the information leak described in CVE-2026-11785.
What is the impact of CVE-2026-11785?
The impact of CVE-2026-11785 is the potential disclosure of partial stack address information to authenticated users in LDAP responses.