CVE-2026-11788
CVE-2026-11788: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium5.9
Medium [CVE-2026-11788] 389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser
CVE-2026-11788Source published Source updated
A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure. Red Hat rates this issue as Moderate impact. If allocation fails, an LDAP search carrying the deref control can crash ns-slapd. The deref plugin is enabled by default, and anonymous clients can send the control when anonymous access is allowed. Natural OOM was not demonstrated end-to-end without fault injection. Disabling the deref plugin removes the vulnerable code path entirely. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-476. Affected products named by the advisory: Red Hat…
- Affected products in this advisory
- Red Hat Directory Server 11.7 E4S for RHEL 8
- Red Hat Directory Server 11.9 for RHEL 8
- Red Hat Directory Server 12.2 E4S for RHEL 9
- Red Hat Directory Server 12.4 E4S for RHEL 9
14 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- redhat-ds:11-8080020260806114250.f969626e
- redhat-ds:11-8100020260803140625.37ed7c03
- redhat-ds:12-9020020260730155601.1674d574
- redhat-ds:12-9040020260810131422.1674d574
26 more entries in the full advisory.
- Mitigation guidance
- Disable the deref plugin (most effective): dsconf <instance> plugin deref disable; systemctl restart dirsrv@<instance>. Disable anonymous access (nsslapd-allow-anonymous-access=off) to raise the bar from pre-auth to authenticated exploitation. Configure memory limits as defense-in-depth: set nsslapd-maxbersize and nsslapd-conntablesize, and deploy in a cgroup with memory limits.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.