Medium severity · published Jun 9, 2026
CVE-2026-11785
389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handler
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Directory Server 12 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Directory Server 13 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: vendor
3D
389 Directory Server · Redhat
All versions, or not specified · source: NVD
DS
Directory Server · Redhat
12.0; 13.0 · source: NVD
EL
Enterprise Linux · Redhat
9.0; 10.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11785
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11785
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-11785
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2485427
More from Red Hat Directory Server 12
9.8
CVE-2026-18922
389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property
9.0
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result
8.8
CVE-2026-11610
389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind
8.4
CVE-2026-19843
389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor
7.6
CVE-2026-11774
389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow