CVE-2026-11793: 389-ds-base: 389-ds-base: stack buffer overflow in checkprefix() algorithm id parsing
A stack buffer overflow exists in 389 Directory Server's checkPrefix() function (pw.c:440-466). When parsing reversible-encrypted attribute values in the format {SCHEME-<algid>}ciphertext, the algorithm ID is copied into a 256-byte stack buffer via memcpy with no bounds check on (end - delim).
An attacker with Directory Manager privileges can crash ns-slapd by storing a crafted nsDS5ReplicaCredentials (or similar reversible-encrypted config attribute) with an oversized algorithm ID. FORTIFYSOURCE (memcpychk) aborts the process before overflow bytes are written, limiting impact to DoS (SIGABRT) only. Code execution is not possible on production builds.
Production crashes confirmed on RHEL 7 (389-ds-base-1.3.11.1-5.el79) and Fedora 42 (389-ds-base-3.1.4-6.fc42). RHEL 8 crash confirmed via dse.ldif injection (389-ds-base-1.4.3.39-2.moduleel8).
Note: cn=config is local configuration and not replicated; triggering requires Directory Manager access on the target server.
Advisory: 389-ds-campaign-2026-04/003-Stack-Overflow-checkPrefix/advisory.md. Source: PSIRTSUPT-7600 (Ian Murphy, Red Hat Product Security).
Other sources
A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix() function in pw.c copies an attacker-controlled algorithm ID into a 256-byte stack buffer without bounds checking when parsing reversible-encrypted attribute values. An attacker with Directory Manager privileges can crash the LDAP server by storing a crafted credential with an oversized algorithm ID. FORTIFYSOURCE mitigates this to denial of service only.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
389-ds-baseto a version that resolves this vulnerability.Fixed in 1.3.11.1-5.el7_9 - Upgrade
Upgrade
389-ds-baseto a version that resolves this vulnerability.Fixed in 3.1.4-6.fc42 - Upgrade
Upgrade
389-ds-baseto a version that resolves this vulnerability.Fixed in 1.4.3.39-2.module_el8 - Compensating control
Restrict Directory Manager privileges so only trusted administrators can modify cn=config on the target server; triggering requires Directory Manager access because cn=config is local and not replicated.
- Compensating control
Rely on FORTIFY_SOURCE (__memcpy_chk) behavior (SIGABRT) to limit impact to denial-of-service (process abort) before overflow bytes are written.
- Operational
If exposure is suspected (e.g., attacker may have attempted dse.ldif injection), monitor ns-slapd for SIGABRT crashes and restart the service after remediation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11793?
The severity of CVE-2026-11793 is medium with a score of 4.9.
How can I mitigate CVE-2026-11793?
To mitigate CVE-2026-11793, ensure that you apply the latest security updates and patches provided by Red Hat.
What type of vulnerability is CVE-2026-11793?
CVE-2026-11793 is classified as a stack buffer overflow vulnerability.
Which software is affected by CVE-2026-11793?
The CVE-2026-11793 vulnerability affects Red Hat 389-ds-base.
What are the potential impacts of CVE-2026-11793?
The potential impacts of CVE-2026-11793 include denial of service due to a stack buffer overflow.