CVE-2026-11790: 389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service
A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.
Other sources
The PBKDF2-SHA256 password storage plugin in 389 Directory Server extracts the iteration count from stored password hashes without an upper bound check. An attacker with Directory Manager privileges can plant a crafted {PBKDF2SHA256} hash with extreme iteration counts (e.g. 0x7FFFFFFF). Any subsequent LDAP BIND as the poisoned account triggers unbounded CPU consumption, hanging a worker thread for hours and enabling persistent denial of service.
Both the C plugin (pbkdf2pwd.c) and Rust plugin (pwdchan/lib.rs) are affected. Distinct from CVE-2024-5953 which added hash length check but not iteration cap.
Introduced in 389-ds-base 1.3.6 (commit 542287ce7, Ticket 397). PoC confirmed on Fedora 42 production binary.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11790?
The severity of CVE-2026-11790 is rated as medium with a score of 4.9.
What kind of attack does CVE-2026-11790 enable?
CVE-2026-11790 enables a denial of service attack due to unbounded iteration count in the PBKDF2 password storage plugin.
How do I fix CVE-2026-11790?
To mitigate CVE-2026-11790, ensure you are using a patched version of the 389-ds-base software that addresses this vulnerability.
Who is affected by CVE-2026-11790?
CVE-2026-11790 affects users of the 389 Directory Server with the PBKDF2-SHA256 password storage plugin.
What can happen if CVE-2026-11790 is exploited?
If exploited, CVE-2026-11790 can lead to excessive CPU consumption during the authentication process, impacting server availability.