Every CVE Search/ Get API key

CVE-2026-11790

389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service

4.9 Medium

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.29%Up 0.2 points since Jun 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.9

389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

Record
CVE-2026-11790
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-05
EUVDEUVD-2026-35422 4.9

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

Record
EUVD-2026-35422
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
GitHub AdvisoriesGHSA-5cpf-527w-96rp 4.9

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not...

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

Record
GHSA-5cpf-527w-96rp
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
NVD 4.9

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

Record
CVE-2026-11790
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-05
OSVDEBIAN-CVE-2026-11790 4.9

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

Record
DEBIAN-CVE-2026-11790
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-11790 4.9

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

Record
UBUNTU-CVE-2026-11790
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVopenSUSE-SU-2026:11600-1 No score

389-ds-3.2.2+4b41542b2-1.1 on GA media

These are all security issues fixed in the 389-ds-3.2.2+4b41542b2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11600-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21691-1 No score

Security update for 389-ds

This update for 389-ds fixes the following issues:

Update to version 3.0.6~git382.7a51ea5f5.

Security issues fixed:

  • CVE-2026-11610: heap buffer overflow in the SASL I/O layer via a crafted oversized LDAP UNBIND packet (bsc#1270695).
  • CVE-2026-11611: unbounded memory growth allowed by the Content Synchronization persistent search plugin when an authenticated client stops reading sync responses (bsc#1267975).
  • CVE-2026-11774: integer overflow in the SASL I/O layer leading to heap buffer overflow via crafted SASL packet length prefixes (bsc#1268298).
  • CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure in LDAP responses to authenticated users (bsc#1268065).
  • CVE-2026-11786: out-of-bounds read in the LDIF parser when processing attribute types with trailing semicolons during database import (bsc#1268064).
  • CVE-2026-11787: heap buffer overread due to missing checks in string filter parsing (bsc#1268062).
  • CVE-2026-11788: server crash due to missing allocation failure checks in the dereference control plugin (bsc#1268057).
  • CVE-2026-11789: integer underflow in the SMD5 password storage plugin leading to a buffer overflow via a crafted password hash (bsc#1268058).
  • CVE-2026-11790: excessive CPU consumption during authentication due to improper upper bounds enforcement in the PBKDF2-SHA256 password storage plugin (bsc#1268060).
  • CVE-2026-11791: use-after-free in the schema reload mechanism can be triggered while concurrent LDAP query traffic is active (bsc#1268047).
  • CVE-2026-11792: heap buffer overflow when audit logging is enabled and short cleartext passwords are logged (bsc#1268046).
  • CVE-2026-11793: stack buffer overflow leading to crash via crafted credentials with an oversized algorithm ID (bsc#1268041).
  • CVE-2026-11884: heap buffer overflow leading to crash when serializing objectclass definitions (bsc#1268115).
  • CVE-2026-12528: heap buffer overflow during ACI parsing via malformed ACI strings (bsc#1268491).

Other updates and bugfixes:

  • Version 3.0.6~git382.7a51ea5f5:
    • Issue 7711 - Fix typo in accountpolicy --login-history-size help text (#7713)
    • Issue 7688 - BUG - partial address leak in sso token (#7689)
    • Issue 7705 - With memberOfEntryScope set, deferred memberOf skips MODIFY operations (#7706)
    • Issue 7698 - Fix silent entry loss in LMDB bulk import waiter handling (#7699)
    • Issue 7666 - Replication performance degradation during total init on high-latency storage (#7667)
    • Issue 7201 - Syscall overhead in LMDB import writer thread (#7204)
    • Issue 7645 - Add runtime LeakSanitizer leak check (#7646)
    • Issue 7714 - UI - sass import rules are deprecated
    • Issue 7658 - Heap Buffer Overflow in sasl_io_recv() via Padded SASL UNBIND
    • Issue 7710 - MemberOf deferred update - Use condvar instead of sleep loop
    • Issue 7637 - UI - Using Arrow Keys in New Object Wizard Resulted in DOM Reload
    • Issue 7578 - schema - attribute refcount is not maintained properly
    • Issue 7605 - Harden CI test ports against ephemeral allocation (#7692)
    • Issue 7528 - Retry the CI image pull instead of failing the job (#7691)
    • Backport Issue 7519 -- ignore obsolete entrydn when entryrdn is in use (#7657)
    • Issue 7460 - MOD_REPLACE on groups/link attributes modifies overlap targets (#7461)
    • Issue 7505 - RFE - CLI - add feature to determine which password policy applies to a user
    • Issue 7670 - BDB range searches intermittently fail with err=1 under write load (#7671)
    • Issue 7108 - Fix shutdown crash in entry cache destruction (#7163)
    • Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7662)
    • Issue 7284 - Automated test for creating local password policy with incorrect passwordInHistory value (#7608)
    • Issue 7200 - repl-agmt create doesn't set some parameters (#7663)
    • Issue 7573 - Post-import cache autotuning does not recompute entry cache size (#7574)

-…

Record
openSUSE-SU-2026:21691-1
Updated
2026-11-02
OSVSUSE-SU-2026:23574-1 No score

Security update for 389-ds

This update for 389-ds fixes the following issues:

Update to version 3.0.6~git382.7a51ea5f5.

Security issues fixed:

  • CVE-2026-11610: heap buffer overflow in the SASL I/O layer via a crafted oversized LDAP UNBIND packet (bsc#1270695).
  • CVE-2026-11611: unbounded memory growth allowed by the Content Synchronization persistent search plugin when an authenticated client stops reading sync responses (bsc#1267975).
  • CVE-2026-11774: integer overflow in the SASL I/O layer leading to heap buffer overflow via crafted SASL packet length prefixes (bsc#1268298).
  • CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure in LDAP responses to authenticated users (bsc#1268065).
  • CVE-2026-11786: out-of-bounds read in the LDIF parser when processing attribute types with trailing semicolons during database import (bsc#1268064).
  • CVE-2026-11787: heap buffer overread due to missing checks in string filter parsing (bsc#1268062).
  • CVE-2026-11788: server crash due to missing allocation failure checks in the dereference control plugin (bsc#1268057).
  • CVE-2026-11789: integer underflow in the SMD5 password storage plugin leading to a buffer overflow via a crafted password hash (bsc#1268058).
  • CVE-2026-11790: excessive CPU consumption during authentication due to improper upper bounds enforcement in the PBKDF2-SHA256 password storage plugin (bsc#1268060).
  • CVE-2026-11791: use-after-free in the schema reload mechanism can be triggered while concurrent LDAP query traffic is active (bsc#1268047).
  • CVE-2026-11792: heap buffer overflow when audit logging is enabled and short cleartext passwords are logged (bsc#1268046).
  • CVE-2026-11793: stack buffer overflow leading to crash via crafted credentials with an oversized algorithm ID (bsc#1268041).
  • CVE-2026-11884: heap buffer overflow leading to crash when serializing objectclass definitions (bsc#1268115).
  • CVE-2026-12528: heap buffer overflow during ACI parsing via malformed ACI strings (bsc#1268491).

Other updates and bugfixes:

  • Version 3.0.6~git382.7a51ea5f5:
    • Issue 7711 - Fix typo in accountpolicy --login-history-size help text (#7713)
    • Issue 7688 - BUG - partial address leak in sso token (#7689)
    • Issue 7705 - With memberOfEntryScope set, deferred memberOf skips MODIFY operations (#7706)
    • Issue 7698 - Fix silent entry loss in LMDB bulk import waiter handling (#7699)
    • Issue 7666 - Replication performance degradation during total init on high-latency storage (#7667)
    • Issue 7201 - Syscall overhead in LMDB import writer thread (#7204)
    • Issue 7645 - Add runtime LeakSanitizer leak check (#7646)
    • Issue 7714 - UI - sass import rules are deprecated
    • Issue 7658 - Heap Buffer Overflow in sasl_io_recv() via Padded SASL UNBIND
    • Issue 7710 - MemberOf deferred update - Use condvar instead of sleep loop
    • Issue 7637 - UI - Using Arrow Keys in New Object Wizard Resulted in DOM Reload
    • Issue 7578 - schema - attribute refcount is not maintained properly
    • Issue 7605 - Harden CI test ports against ephemeral allocation (#7692)
    • Issue 7528 - Retry the CI image pull instead of failing the job (#7691)
    • Backport Issue 7519 -- ignore obsolete entrydn when entryrdn is in use (#7657)
    • Issue 7460 - MOD_REPLACE on groups/link attributes modifies overlap targets (#7461)
    • Issue 7505 - RFE - CLI - add feature to determine which password policy applies to a user
    • Issue 7670 - BDB range searches intermittently fail with err=1 under write load (#7671)
    • Issue 7108 - Fix shutdown crash in entry cache destruction (#7163)
    • Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7662)
    • Issue 7284 - Automated test for creating local password policy with incorrect passwordInHistory value (#7608)
    • Issue 7200 - repl-agmt create doesn't set some parameters (#7663)
    • Issue 7573 - Post-import cache autotuning does not recompute entry cache size (#7574)

-…

Record
SUSE-SU-2026:23574-1
Updated
2026-11-02
OSVSUSE-SU-2026:3136-1 No score

Security update for 389-ds

This update for 389-ds fixes the following issues:

Update to version 2.2.10~git255.752643c78.

Security issues fixed:

  • CVE-2026-11610: missing bounds check in sasl_io_recv() can lead to a heap buffer overflow when processing a specially crafted oversized LDAP UNBIND packet (bsc#1270695).
  • CVE-2026-11611: Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses(bsc#1267975).
  • CVE-2026-11774: integer overflow in sasl_io_start_packet() can lead to heap buffer overflow when processing a crafted SASL packet length prefix (bsc#1268298).
  • CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure in LDA responses (bsc#1268065).
  • CVE-2026-11786: out-of-bounds read in the LDIF parser when processing attribute types with trailing semicolons during database import (bsc#1268064).
  • CVE-2026-11787: missing bounds check in the ldap_utf8prev() functioncan can lead to a heap buffer overread in string filter parsing(bsc#1268062).
  • CVE-2026-11788: missing allocation check in the dereference control plugin before using a BER structure can lead to LDAP server crash when the system is under memory pressure (bsc#1268057).
  • CVE-2026-11789: integer underflow in the SMD5 password storage plugin can lead to a buffer overread when computing salt length from a crafted password hash shorter than 16 bytes (bsc#1268058).
  • CVE-2026-11790: improper bounds enforcement in the BKDF2-SHA256 password storage plugin can lead to excessive resource consumption during authentication and cause a DoS (bsc#1268060).
  • CVE-2026-11791: use-after-free in the schema reload mechanism can lead to a ns-slapd crash when concurrent LDAP query traffic is active (bsc#1268047).
  • CVE-2026-11792: missing checks in create_masked_entry_string can lead to a heap and log output corruption whe a short cleartext password is logged (bsc#1268046).
  • CVE-2026-11793: missing bounds check in checkPrefix() can lead to a stack buffer overflow when processing an algorithm ID during parsing of reversible-encrypted attribute values (bsc#1268041).
  • CVE-2026-11884: improper string management can lead to heap buffer overflow when serializing objectclass definitions (bsc#1268115).
  • CVE-2026-12528: missing length checks in the __aclp__normalize_acltxt() function can lead to heap buffer overflow when processing a malformed ACI string (bsc#1268491).

Other updates and bugfixes:

  • Version 2.2.10~git255.752643c78.
    • Issue 7406 - Fix ldap-agent SNMP stats file loading (#7630)
    • Issue 7621 - Stack Buffer Overflow in Password checkPrefix
    • Issue 7623 - Heap Buffer Overflow in 389-ds-base Audit Log Password Masking
    • Issue 6625 - Backport get_pid to fix check_asan_report (#7625)
    • Issue 7602 - CI - lib389 user compare fails due to parentid mismatch (#7603)
    • Issue 7537 - CI - Fix replication log monitoring parser/timing failures (#7592)
    • Issue 7593 - Fix testimony docstring for SASL overflow test (#7606)
    • Issue 7530 - CI - Stabilize DNA plugin replication tests timing out in CI (#7572)
    • Issue 7593 - Reject invalid SASL packet length values in sasl_io_start_packet (#7594)
    • Issue 3555 - UI - Fix audit issue with npm - ws, js-yaml, js-yaml , postcss, uuid
    • Issue 7541 - Add invalid ACL text header regression test (#7591)
    • Issue 7541 - heap-buffer-overflows in __aclp__normalize_acltxt() (#7542)
    • Issue 7576 - Fix leak of temporary attribute syntax hash tables after schema reload
    • Issue 7558 - During online import, the IDL should be created with in-depth first approach (#7559)
    • Issue 7500 - Prevent unsigned integer underflow during stalled import
    • Issue 7560 - lib389 - Add helper function for checking ASAN files
    • Issue 7539 - Server shutdown during online reindex may lead to data loss (#7540)
    • Issue 7549 - Substring index should validate minimum…
Record
SUSE-SU-2026:3136-1
Updated
2026-11-02
OSVSUSE-SU-2026:3137-1 No score

Security update for 389-ds

This update for 389-ds fixes the following issues:

Update to version 2.2.10~git255.752643c78.

Security issues fixed:

  • CVE-2026-11610: missing bounds check in sasl_io_recv() can lead to a heap buffer overflow when processing a specially crafted oversized LDAP UNBIND packet (bsc#1270695).
  • CVE-2026-11611: Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses(bsc#1267975).
  • CVE-2026-11774: integer overflow in sasl_io_start_packet() can lead to heap buffer overflow when processing a crafted SASL packet length prefix (bsc#1268298).
  • CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure in LDA responses (bsc#1268065).
  • CVE-2026-11786: out-of-bounds read in the LDIF parser when processing attribute types with trailing semicolons during database import (bsc#1268064).
  • CVE-2026-11787: missing bounds check in the ldap_utf8prev() functioncan can lead to a heap buffer overread in string filter parsing(bsc#1268062).
  • CVE-2026-11788: missing allocation check in the dereference control plugin before using a BER structure can lead to LDAP server crash when the system is under memory pressure (bsc#1268057).
  • CVE-2026-11789: integer underflow in the SMD5 password storage plugin can lead to a buffer overread when computing salt length from a crafted password hash shorter than 16 bytes (bsc#1268058).
  • CVE-2026-11790: improper bounds enforcement in the BKDF2-SHA256 password storage plugin can lead to excessive resource consumption during authentication and cause a DoS (bsc#1268060).
  • CVE-2026-11791: use-after-free in the schema reload mechanism can lead to a ns-slapd crash when concurrent LDAP query traffic is active (bsc#1268047).
  • CVE-2026-11792: missing checks in create_masked_entry_string can lead to a heap and log output corruption whe a short cleartext password is logged (bsc#1268046).
  • CVE-2026-11793: missing bounds check in checkPrefix() can lead to a stack buffer overflow when processing an algorithm ID during parsing of reversible-encrypted attribute values (bsc#1268041).
  • CVE-2026-11884: improper string management can lead to heap buffer overflow when serializing objectclass definitions (bsc#1268115).
  • CVE-2026-12528: missing length checks in the __aclp__normalize_acltxt() function can lead to heap buffer overflow when processing a malformed ACI string (bsc#1268491).

Other updates and bugfixes:

  • Version 2.2.10~git255.752643c78.
    • Issue 7406 - Fix ldap-agent SNMP stats file loading (#7630)
    • Issue 7621 - Stack Buffer Overflow in Password checkPrefix
    • Issue 7623 - Heap Buffer Overflow in 389-ds-base Audit Log Password Masking
    • Issue 6625 - Backport get_pid to fix check_asan_report (#7625)
    • Issue 7602 - CI - lib389 user compare fails due to parentid mismatch (#7603)
    • Issue 7537 - CI - Fix replication log monitoring parser/timing failures (#7592)
    • Issue 7593 - Fix testimony docstring for SASL overflow test (#7606)
    • Issue 7530 - CI - Stabilize DNA plugin replication tests timing out in CI (#7572)
    • Issue 7593 - Reject invalid SASL packet length values in sasl_io_start_packet (#7594)
    • Issue 3555 - UI - Fix audit issue with npm - ws, js-yaml, js-yaml , postcss, uuid
    • Issue 7541 - Add invalid ACL text header regression test (#7591)
    • Issue 7541 - heap-buffer-overflows in __aclp__normalize_acltxt() (#7542)
    • Issue 7576 - Fix leak of temporary attribute syntax hash tables after schema reload
    • Issue 7558 - During online import, the IDL should be created with in-depth first approach (#7559)
    • Issue 7500 - Prevent unsigned integer underflow during stalled import
    • Issue 7560 - lib389 - Add helper function for checking ASAN files
    • Issue 7539 - Server shutdown during online reindex may lead to data loss (#7540)
    • Issue 7549 - Substring index should validate minimum…
Record
SUSE-SU-2026:3137-1
Updated
2026-11-02
OSVSUSE-SU-2026:3138-1 No score

Security update for 389-ds

This update for 389-ds fixes the following issues

  • Update to version 2.7.0~git212.9b0755edb.
  • CVE-2026-11610: heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (bsc#1270695).
  • CVE-2026-11611: content synchronization persistent search plugin can allow unbounded memory growth (bsc#1267975).
  • CVE-2026-11774: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (bsc#1268298).
  • CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure (bsc#1268065).
  • CVE-2026-11786: lack of length check can cause an out-of-bounds read (bsc#1268064).
  • CVE-2026-11787: lack of bounds check can lead to a heap buffer overread (bsc#1268062).
  • CVE-2026-11788: lack of allocation failure check can lead to NULL pointer dereference (bsc#1268057).
  • CVE-2026-11789: crafted SMD5 hash can lead to an integer underflow (bsc#1268058).
  • CVE-2026-11790: crafted password hash can cause excessive CPU consumption (bsc#1268060).
  • CVE-2026-11791: schema reload triggered during concurrent LDAP query traffic can lead to a use-after-free (bsc#1268047).
  • CVE-2026-11792: password value shorter than 23 characters can cause a heap buffer overflow (bsc#1268046).
  • CVE-2026-11793: crafted nsDS5ReplicaCredentials can lead to a stack buffer overflow (bsc#1268041).
  • CVE-2026-11884: remote code execution and denial of service via heap buffer overflow (bsc#1268115).
  • CVE-2026-12528: heap buffer overflows in __aclp__normalize_acltxt() (bsc#1268491).
Record
SUSE-SU-2026:3138-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
389-ds-base
Debian:12
 All versions, plus listed versions
2.3.1+dfsg1-12.3.1+dfsg1-1+deb12u12.3.4+dfsg1-12.3.4+dfsg1-1.12.4.4+dfsg1-1
Show 13 moreShow less
2.4.4+dfsg1-32.4.5+dfsg1-13.0.2+dfsg1-13.1.1+dfsg1-13.1.1+dfsg1-23.1.1+dfsg1-33.1.2+dfsg1-13.1.2+vendor1-13.1.2+vendor1-23.3.0-13.3.0-23.3.1-13.3.1-3
 None known
389-ds-base
Debian:13
 All versions, plus listed versions
3.1.2+dfsg1-13.1.2+dfsg1-1+deb13u13.1.2+vendor1-13.1.2+vendor1-23.3.0-13.3.0-23.3.1-13.3.1-3
 None known
389-ds
SUSE:Linux Enterprise Server 16.0
From an advisory covering 14 CVEs
 before 3.0.6~git382.7a51ea5f5-160000.1.1
3.0.6~git382.7a51ea5f5-160000.1.1
389-ds
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 14 CVEs
 before 3.0.6~git382.7a51ea5f5-160000.1.1
3.0.6~git382.7a51ea5f5-160000.1.1
389-ds
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 14 CVEs
 before 2.2.10~git255.752643c78-150600.8.32.1
2.2.10~git255.752643c78-150600.8.32.1
389-ds
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 14 CVEs
 before 2.2.10~git255.752643c78-150600.8.32.1
2.2.10~git255.752643c78-150600.8.32.1
389-ds
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 14 CVEs
 before 2.2.10~git255.752643c78-150500.3.48.1
2.2.10~git255.752643c78-150500.3.48.1
389-ds
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 14 CVEs
 before 2.2.10~git255.752643c78-150500.3.48.1
2.2.10~git255.752643c78-150500.3.48.1
389-ds
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 14 CVEs
 before 2.2.10~git255.752643c78-150500.3.48.1
2.2.10~git255.752643c78-150500.3.48.1
389-ds
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 14 CVEs
 before 2.2.10~git255.752643c78-150500.3.48.1
2.2.10~git255.752643c78-150500.3.48.1
Show 11 moreShow less
Affected packages
PackageAffectedFixed
389-ds
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 14 CVEs
 before 2.7.0~git212.9b0755edb-150700.3.19.1
2.7.0~git212.9b0755edb-150700.3.19.1
389-ds-base
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.3.3.12-1build11.3.3.13-11.3.4.5-21.3.4.8-11.3.4.8-3
Show 4 moreShow less
1.3.4.8-3ubuntu11.3.4.8-41.3.4.9-11.3.4.9-1ubuntu0.1~esm1
 None known
389-ds-base
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.3.7.5-11.3.7.5-1build11.3.7.5-1build21.3.7.9-11.3.7.10-11.3.7.10-1ubuntu11.3.7.10-1ubuntu1+esm1
 None known
389-ds-base
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.4.1.6-41.4.1.6-4build11.4.2.4-11.4.2.4-1build11.4.3.2-11.4.3.2-1build11.4.3.6-21.4.3.6-2ubuntu0.1~esm1
 None known
389-ds-base
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.4.4.11-2build11.4.4.11-2build21.4.4.17-12.0.11-22.0.14-12.0.15-12.0.15-1ubuntu2
 None known
389-ds-base
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.3.4+dfsg1-12.4.4+dfsg1-1ubuntu12.4.4+dfsg1-1ubuntu42.4.4+dfsg1-32.4.5+dfsg1-1
 None known
389-ds-base
Ubuntu:25.10
 All versions, plus listed versions
3.1.2+dfsg1-1
 None known
389-ds-base
Ubuntu:26.10
 All versions, plus listed versions
3.1.2+vendor1-23.1.2+vendor1-2build13.3.1-3
 None known
389-ds-base
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.1.2+dfsg1-13.1.2+vendor1-2
 None known
389-ds
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 3.2.2+4b41542b2-1.1
3.2.2+4b41542b2-1.1
389-ds
openSUSE:Leap 16.0
From an advisory covering 14 CVEs
 before 3.0.6~git382.7a51ea5f5-160000.1.1
3.0.6~git382.7a51ea5f5-160000.1.1

History

History
RecordedChangedSources
affected, factsEUVD, NVD
factsCVE List
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-11790 is a medium vulnerability (CVSS 4.9) in Redhat 389 Directory Server, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. No source names a fixed version.

References

Show 35 moreShow less
This page doesn't list everything

Left out here: the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open