CVE-2026-11789

6.5 Moyenne

Publiée le 09/06/2026 à 16:16 · Modifiée le 23/07/2026 à 10:10 · Modifiée · Source : secalert@redhat.com

Description

A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a crafted password hash shorter than 16 bytes, causing a buffer over-read that crashes the LDAP server during authentication.

Traduire en français

Produits concernés

Red Hat Directory Server 11
Red Hat Directory Server 12
Red Hat Directory Server 13
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Redhat directory server
Redhat 389 directory server
Redhat enterprise linux

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.9 Moyenne	secalert@redhat.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H`
3.1	6.5 Moyenne	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-191

Références

https://access.redhat.com/security/cve/CVE-2026-11789 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2485422 Issue TrackingVendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories