VDB

CVE-2026-11786

CVE-2026-11786 PUBLISHED CVSS 1.9 LOW

Reported by redhat · Published June 9, 2026

A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during database import, causing an out-of-bounds read detectable under memory instrumentation.

Risk Scores

CVSS 3.1
1.9
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Affected Products

VendorProductVersions
Red HatRed Hat Directory Server 11
Red HatRed Hat Directory Server 12
Red HatRed Hat Directory Server 13
Red HatRed Hat Enterprise Linux 10
Red HatRed Hat Enterprise Linux 6
Red HatRed Hat Enterprise Linux 7
Red HatRed Hat Enterprise Linux 8
Red HatRed Hat Enterprise Linux 9
Red HatRed Hat Enterprise Linux 9
Red HatRed Hat Directory Server 11
Red HatRed Hat Enterprise Linux 10
Red HatRed Hat Enterprise Linux 8
Red HatRed Hat Directory Server 12
Red HatRed Hat Enterprise Linux 7
Red HatRed Hat Enterprise Linux 6
Red HatRed Hat Directory Server 13

Timeline

  • Jun 9, 2026 CVE Published
  • Jun 10, 2026 Coalition ESS Score
  • Jun 11, 2026 Security Advisory
  • Jun 30, 2026 CVE Updated
  • Aug 7, 2026 EPSS Score
  • Aug 24, 2026 EPSS Score
  • Aug 27, 2026 EPSS Score
  • Sep 16, 2026 EPSS Score
  • Sep 24, 2026 EPSS Score
  • Sep 30, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›