CVE-2026-11788

A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.

Red Hat rates this issue as Moderate impact. The dereference control plugin in 389-ds-base does not check whether ber_init() succeeded before using the BER structure. If allocation fails, an LDAP search carrying the deref control can crash ns-slapd. The deref plugin is enabled by default, and anonymous clients can send the control when anonymous access is allowed. NVD rates this 7.5 (AC:L); Red Hat rates 5.9 (AC:H) because the NULL return from ber_init() occurs when memory allocation fails, not from a crafted control payload alone—a well-formed deref search on a server with normal free memory does not trigger the crash. Natural OOM was not demonstrated end-to-end without fault injection. Disabling the deref plugin removes the vulnerable code path entirely.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the deref plugin (most effective): dsconf <instance> plugin deref disable; systemctl restart dirsrv@<instance>. Disable anonymous access (nsslapd-allow-anonymous-access=off) to raise the bar from pre-auth to authenticated exploitation. Configure memory limits as defense-in-depth: set nsslapd-maxbersize and nsslapd-conntablesize, and deploy in a cgroup with memory limits.