CVE-2026-11611

A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses, enabling denial of service. Additional race conditions in plugin thread lifecycle can cause crashes during connection teardown or shutdown.

Red Hat rates this issue as Moderate impact. The Content Synchronization persistent search plugin in 389-ds-base allows unbounded memory growth when an authenticated client opens a sync search and stops reading responses—modification events queue until memory exhaustion and server crash (confirmed on production binaries). Any authenticated user with search ACL access can trigger the primary denial-of-service path. Additional race conditions during connection teardown or shutdown can cause crashes on weak-memory-model architectures. These secondary paths have no configuration workaround.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Bug 1 (Queue DoS): Reduce SYNC_MAX_CONCURRENT from the default of 10 to minimize the number of clients that can accumulate queues. Apply network-level rate limiting on persistent sync search requests. Monitor client connections and terminate stalled sync clients that stop reading for an extended period. Set system-level memory limits (e.g., LimitAS= in the systemd unit file or cgroup memory limits) to prevent unbounded memory growth. Bugs 2 and 3: No workaround available — these are code-level race conditions that require source fixes.