CVE-2026-11785: 389 Directory Server Stack Address Disclosure via Type Confusion

Technical summary

The vulnerability stems from type confusion in the SSO (Single Sign-On) token extended operation handler within 389 Directory Server. When processing specially crafted SSO token requests from an authenticated LDAP client, the handler mishandles object types, leading to an out-of-bounds read or similar memory access that captures stack frames. These frames contain return addresses and other stack metadata, which are then reflected back in LDAP protocol responses. The flaw is rooted in CWE-843 (Access of Resource Using Incompatible Type), a type safety issue common in C/C++ codebases that interact with weakly-typed protocol handlers.

Business impact

Organizations relying on 389 Directory Server for LDAP-based authentication and SSO face a two-stage risk. First, any authenticated user (or attacker with compromised credentials) can harvest stack address information, useful for reconnaissance. Second, this information can be combined with other memory safety bugs to construct reliable exploits against higher-privilege processes. In environments where LDAP is a critical authentication hub (universities, large enterprises, cloud providers), even a low-severity leak can be problematic when multiplied across many user interactions or when combined with other vulnerabilities.

Affected systems

Red Hat Directory Server and 389 Directory Server (the upstream open-source project) are directly affected, along with Red Hat Enterprise Linux systems that package these components. The vulnerability requires an authenticated LDAP session, so exposure is limited to installations where LDAP access is permitted. Verify your specific Directory Server version and RHEL release against Red Hat's official advisory to confirm whether you are running an affected build.

Exploitability

The attack vector is network-accessible and requires low attack complexity, but it mandates prior authentication (PR:L in the CVSS vector). An attacker cannot exploit this without valid LDAP credentials—either stolen, leaked, or obtained through social engineering. The disclosed information is partial and address-only; it does not directly compromise confidentiality of user data or cause denial of service. However, the predictability of modern exploit techniques means that even partial ASLR defeats significantly lower the bar for subsequent memory corruption attacks.

Remediation

Apply security updates from Red Hat as soon as they become available. Check Red Hat Security Advisories (RHSA) and the 389 Directory Server release notes for patched versions. In the interim, restrict LDAP access to trusted networks and authenticated users only; monitor LDAP query logs for anomalous SSO token operations. Consider implementing LDAP rate limiting or WAF-style request filtering if your directory is internet-facing.

Patch guidance

Monitor Red Hat's official security portal and subscribe to 389 Directory Server mailing lists for patch releases. When updates are published, test them in a non-production environment to validate compatibility with your authentication workflows. Given that the vulnerability requires authentication, patching should be scheduled during normal maintenance windows rather than emergency escalation—though security teams should prioritize it over routine updates.

Detection guidance

Monitor LDAP logs for repeated SSO token extended operations from the same authenticated user or IP address, especially if followed by failed bind attempts or unusual query patterns. Network-based detection is difficult because the requests are valid LDAP protocol frames; focus on behavior analytics. Baseline your LDAP server's normal SSO token operation rate and alert on deviations. Intrusion detection systems should be configured to flag multiple sequential extended operations within short time windows, particularly from accounts with high privileges.

Why prioritize this

Although the CVSS score of 4.3 (MEDIUM) is modest, the vulnerability sits at the intersection of information disclosure and defensive evasion. The leak of stack addresses is a classic stepping stone to privilege escalation or remote code execution in mixed vulnerability environments. Organizations with mature security postures should prioritize this over purely cosmetic bugs, but it does not warrant crisis response unless combined with evidence of active exploitation or if your LDAP server is internet-facing and unprotected.

Risk score, explained

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N reflects: network-accessible endpoint (AV:N), low attack complexity (AC:L), low impact (confidentiality only, no integrity or availability loss), and mandatory prior authentication (PR:L). The score of 4.3 is driven down by the authentication requirement and the limited scope of disclosed data. Organizations with open LDAP ports should weigh this higher; those with restricted LDAP access behind firewalls and VPNs may safely deprioritize relative to other vulnerabilities.

Frequently asked questions