CVE-2026-11884

A heap buffer overflow flaw was found in 389 Directory Server. When serializing objectclass definitions, the oc_superior (SUP) field length is omitted from buffer size calculations in read_schema_dse() and schema_oc_to_string(), but the field is still written via strcat(). An attacker with Directory Manager privileges, or a compromised replication supplier, can trigger a server crash by creating objectclasses with long SUP values. This is an incomplete fix variant of CVE-2025-14905.

Red Hat rates this issue as Moderate impact. When serializing objectclass definitions in 389-ds-base, the oc_superior (SUP) field length is omitted from buffer size calculations in read_schema_dse() and schema_oc_to_string(), but the field is still written—an incomplete fix variant of CVE-2025-14905. Directory Manager can crash the server with long SUP values; a compromised replication supplier may push malicious schema to consumers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict Directory Manager access. Audit replication agreements. Monitor cn=schema modifications for unusually long SUP values. Restrict LDAP replication traffic to trusted networks.