CVE-2026-11789: 389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash
A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a crafted password hash shorter than 16 bytes, causing a buffer over-read that crashes the LDAP server during authentication.
Other sources
The SMD5 password storage plugin in 389 Directory Server computes salt length by subtracting MD5LENGTH (16) from the decoded hash length using unsigned 32-bit arithmetic. When the stored hash is shorter than 16 bytes, the subtraction wraps to approximately 4GB. PK11DigestOp() then reads from a small stack buffer into unmapped memory, crashing ns-slapd with SIGSEGV.
An attacker with Directory Manager privileges plants a crafted SMD5 hash; any subsequent BIND triggers instant crash. Missed variant of CVE-2024-5953 which patched md5pwd.c and pbkdf2pwd.c but not smd5pwd.c.
Present since smd5pwd.c creation (~2005). PoC confirmed on Fedora 42 production binary.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11789?
CVE-2026-11789 has a medium severity score of 4.9.
How do I fix CVE-2026-11789?
To mitigate CVE-2026-11789, update to the latest version of Red Hat 389-ds-base that addresses this vulnerability.
What impact does CVE-2026-11789 have on my system?
CVE-2026-11789 can lead to a crash of the LDAP server during authentication due to a buffer over-read.
Is CVE-2026-11789 being actively exploited?
As of now, there are no reported active exploits for CVE-2026-11789.
What systems are affected by CVE-2026-11789?
CVE-2026-11789 affects the Red Hat 389-ds-base software specifically using the SMD5 password storage plugin.