CVE-2026-11791

Katalog CVE

CVSS 5.0 · Medium EPSS 0,35%

Kerentanan Use After Free pada redhat directory server, redhat 389 directory server +1 lainnya. Skor CVSS 3.1 5.0 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function unconditionally frees attribute syntax information nodes, bypassing the refcount-based deferred deletion used elsewhere in the attribute syntax subsystem. If an administrator triggers schema reload while concurrent LDAP query traffic is active, worker threads may access freed memory, resulting in use-after-free or double-free and a denial of service (server crash).

Rincian

Terbit di NVD

18 Juni 2026

Terakhir diubah

30 Juni 2026

Status NVD

Modified

CVSS 3.1

5.0 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-11791 mitigasi · advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2485414 issue tracking · advisory vendor