CVE-2026-11790

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

Red Hat rates this issue as Moderate impact. The PBKDF2-SHA256 password storage plugin in 389-ds-base accepts unbounded iteration counts from stored password hashes. An attacker with Directory Manager access can plant a hash with extreme iterations; subsequent BIND operations hang worker threads for hours, enabling persistent denial of service. The poisoned hash persists in the database and re-triggers on every bind, so recovery requires Directory Manager access to replace the hash. This is distinct from CVE-2024-5953, which added hash length checks but not an iteration cap.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable nsslapd-allow-hashed-passwords (default: off) to prevent non-DM users from setting pre-hashed passwords. Restrict Directory Manager credentials; limit DM access to management networks and audit DM operations via nsslapd-auditlog. Monitor for suspicious userPassword modifications (unusual hash schemes or large base64 payloads). Monitor for unusually long bind operations to the same account, which may indicate a poisoned PBKDF2 hash.