CVE-2026-11791: 389 Directory Server Schema Reload Use-After-Free DoS

Technical summary

CVE-2026-11791 is a use-after-free vulnerability in the attr_syntax_swap_ht() function within 389 Directory Server's attribute syntax subsystem. During schema reload operations, the function unconditionally deallocates attribute syntax information nodes without respecting the refcount-based deferred deletion mechanism used elsewhere in the same subsystem. When LDAP worker threads concurrently access these freed structures, memory safety violations occur, manifesting as use-after-free or double-free conditions that cause process termination. The vulnerability is classified as CWE-416 (Use After Free).

Business impact

Schema reload is typically an administrative maintenance task performed on running directory servers. Exploitation of this flaw triggers immediate service unavailability, disrupting authentication and authorization services for any applications or systems dependent on the directory. Recovery requires server restart and investigation of the triggering conditions. Organizations with frequent schema maintenance windows, those running in high-concurrency environments, or those with automated schema management pipelines face elevated operational risk. There is no confidentiality or integrity impact.

Affected systems

The vulnerability affects Red Hat 389 Directory Server and Red Hat Enterprise Linux systems that include or depend on 389 Directory Server. The exact affected versions are not enumerated in the advisory data provided; verify the official Red Hat security bulletin for your specific deployment's version coverage and applicable errata.

Exploitability

Exploitation requires high privilege (schema administration rights) and a specific race condition: the attacker must trigger schema reload while concurrent LDAP traffic is active. The high access control requirements and the need to achieve precise timing reduce the practical likelihood of exploitation from external threat actors. Insider threats or compromised administrative accounts pose the primary risk. This vulnerability does not appear on CISA's Known Exploited Vulnerabilities catalog.

Remediation

Apply vendor security updates provided by Red Hat for affected 389 Directory Server and Enterprise Linux versions. Coordinate patching with change management to minimize service interruption. Until patches are deployed, restrict schema reload operations to maintenance windows when LDAP traffic can be gracefully quiesced or the service briefly stopped. Monitor administrative activity and audit schema reload events.

Patch guidance

Check the Red Hat security advisories and errata portal for updates addressing CVE-2026-11791. Test patches in non-production environments that replicate your schema complexity and query concurrency levels. Establish a maintenance window for deployment, ensuring all dependent applications are prepared for temporary directory service downtime during the patch cycle. Verify functionality post-patching before returning the service to full operational load.

Detection guidance

Monitor system logs and directory server diagnostics for unexpected crashes correlated with schema reload operations initiated by administrators. Examine error logs for segmentation faults or memory violation messages coinciding with admin activity timestamps. Audit logs should record all schema modifications; correlate timing with crash events. LDAP monitoring tools may detect service unavailability spikes. Proactive health checks (e.g., LDAP bind tests) can alert to unexpected service loss.

Why prioritize this

Although the CVSS score is MEDIUM (5.0), prioritization should be informed by environmental context. Organizations with automated or frequent schema management face elevated risk. However, the requirement for high privilege and active query concurrency limits applicability to many deployments. Prioritize if your environment has: (1) routine or automated schema reload procedures, (2) persistent LDAP query load, or (3) schema management as part of operational tooling. Otherwise, schedule patching in normal update cycles.

Risk score, explained

The CVSS 3.1 score of 5.0 reflects the accessibility via the network (AV:N) and high privilege requirement (PR:H), combined with high impact to availability (A:H) but no confidentiality or integrity impact (C:N/I:L). The high attack complexity (AC:H) due to race condition timing requirements moderates the score. The severity rating of MEDIUM appropriately captures a denial-of-service risk that is conditional on administrative action and concurrency.

Frequently asked questions