CVE-2026-11788: 389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser
A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.
Other sources
The dereference control plugin in 389 Directory Server fails to check the return value of berinit() for NULL before use in derefparsectrlvalue() (deref.c). When memory allocation fails under memory pressure, an unauthenticated LDAP client sending a search with the deref control can crash ns-slapd.
The deref plugin is enabled by default. Crash confirmed via GDB fault injection on Fedora 42 (SIGABRT) and CentOS 7 (SIGSEGV on OpenLDAP 2.4). Vulnerable code present since deref plugin introduction in 389-ds-base 1.2.6 (~2010).
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
389-ds-baseto a version that resolves this vulnerability.Fixed in 1.2.6 - Configuration
Disable the dereference control plugin (deref control) in 389 Directory Server to prevent unauthenticated remote LDAP clients from crashing ns-slapd via the deref control under memory pressure.
389 Directory Server (deref control plugin) deref control plugin enabled by default = disable - Compensating control
Add a compensating network control to reduce exposure to unauthenticated LDAP search requests that use the deref control (e.g., restrict LDAP access/allow only trusted clients at the firewall/ACL).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11788?
CVE-2026-11788 has a medium severity score of 5.9.
What does CVE-2026-11788 affect?
CVE-2026-11788 affects the 389-ds-base component of the 389 Directory Server.
How do I fix CVE-2026-11788?
To fix CVE-2026-11788, ensure that you update the 389-ds-base software to the latest version provided by the vendor.
What type of vulnerability is CVE-2026-11788?
CVE-2026-11788 is a null pointer dereference vulnerability in the dereference control plugin.
Who can exploit CVE-2026-11788?
CVE-2026-11788 can be exploited by an unauthenticated remote attacker.