CVE-2026-11793: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-11793 is a stack-based buffer overflow vulnerability in 389 Directory Server (389-ds-base), affecting the checkPrefix() function in pw.c. The flaw allows an attacker with Directory Manager privileges to crash the LDAP server (ns-slapd) by supplying a crafted credential with an oversized algorithm ID. Crashes have been confirmed on RHEL 7 (389-ds-base-1.3.11.1-5.el7_9), RHEL 8 (389-ds-base-1.4.3.39-2.module_el8), and Fedora 42 (389-ds-base-3.1.4-6.fc42). The vulnerability was reported on June 4, 2026, and publicly disclosed on June 9, 2026, with a CVSS v3.1 base score of 4.9 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a stack-based buffer overflow (CWE-121) in the checkPrefix() function located at pw.c:440-466. When parsing reversible-encrypted attribute values in the format {SCHEME-}ciphertext, the algorithm ID portion is copied into a fixed 256-byte stack buffer via memcpy without any bounds check on the length (end - delim). An attacker with Directory Manager privileges can exploit this by storing a crafted nsDS5ReplicaCredentials (or similar reversible-encrypted config attribute) with an algorithm ID exceeding 256 bytes. On production builds compiled with FORTIFY_SOURCE, the __memcpy_chk guard aborts the process via SIGABRT before overflow bytes are written, preventing code execution and limiting the impact to denial of service; code execution is not possible on standard production builds (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation causes the ns-slapd LDAP server process to crash (SIGABRT), resulting in a denial of service for all LDAP-dependent services and applications. There is no confidentiality or integrity impact, as FORTIFY_SOURCE prevents memory corruption from being leveraged for code execution on production builds. Because cn=config is local and not replicated, the attacker must have Directory Manager access on the specific target server, limiting the blast radius to that instance (Red Hat Bugzilla, GitHub Advisory).

1. Gain Directory Manager Access: Obtain Directory Manager credentials for the target 389 Directory Server instance — this is a prerequisite and the primary barrier to exploitation.
2. Craft a malicious LDAP attribute value: Construct a reversible-encrypted attribute value (e.g., for nsDS5ReplicaCredentials) where the algorithm ID prefix (the portion between { and -}) exceeds 256 bytes.
3. Store the crafted value: Use an LDAP client (e.g., ldapmodify) authenticated as Directory Manager to write the crafted attribute value to the directory, targeting a configuration entry such as a replication agreement.
4. Trigger the crash: When the server parses the stored attribute value and calls checkPrefix(), the oversized algorithm ID is copied into the 256-byte stack buffer, triggering FORTIFY_SOURCE's __memcpy_chk guard, which aborts ns-slapd with SIGABRT, causing a denial of service (Red Hat Bugzilla).

• Logs: Unexpected ns-slapd process crash entries (SIGABRT) in /var/log/dirsrv/slapd-<instance>/errors; core dump files generated in the 389-ds working directory.
• Process: Sudden termination of the ns-slapd process without a graceful shutdown; repeated restarts of the 389 Directory Server service.
• File System: Unexpected modifications to dse.ldif or replication agreement entries containing unusually long algorithm ID strings in reversible-encrypted attribute values (e.g., nsDS5ReplicaCredentials).
• Network: LDAP modify or add operations from a Directory Manager account targeting replication configuration entries with oversized attribute values, visible in LDAP access logs.

Apply the vendor-supplied patch from Red Hat for the affected 389-ds-base packages (specific fixed version numbers are pending publication in the Red Hat advisory). Ensure that 389 Directory Server builds are compiled with FORTIFY_SOURCE enabled, which limits the impact to denial of service only and prevents code execution. As an access control measure, restrict Directory Manager privileges to the minimum number of trusted administrators, and audit existing Directory Manager accounts. Monitor Red Hat's security advisory page for updated package versions (Red Hat CVE, GitHub Advisory).

The vulnerability was reported internally by Ian Murphy of Red Hat Product Security (PSIRTSUPT-7600) and processed through Red Hat's standard security response workflow. The GitHub Advisory Database has classified it as Moderate severity. No notable public researcher commentary or significant social media discussion has been observed beyond standard CVE aggregator coverage.