Bug 2561778 (CVE-2026-117548)

Summary:	CVE-2026-117548 389-ds-base: 389-ds-base: NULL pointer dereference via ModifyDN using an attribute's schema alias name causes denial of service
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bsmejkal, jachapma, lryznaro, mreynolds, msauton, progier, rhel-process-autobot, snegrini, spichugi, tbordaz, vashirov, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as "commonName") instead of its canonical name (such as "cn") as the new relative distinguished name. An authenticated attacker with the ModifyDN (rename) permission on the affected entry can use this flaw to crash the directory server, causing a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-27 11:09:12 UTC

A flaw was found in 389-ds-base. When processing a ModifyDN (rename) request whose new relative distinguished name (RDN) uses an attribute's schema alias name (for example, "commonName") instead of its canonical name (for example, "cn"), the server fails to recognize that the aliased attribute already exists on the target entry. This causes the directory server to construct a duplicate, inconsistent internal attribute structure for the entry. A subsequent internal lookup against this inconsistent structure dereferences a NULL pointer, crashing the ns-slapd process. An authenticated user holding the "moddn" (rename) access control right on an entry can use this flaw to crash the directory server, resulting in a denial of service for all users of that directory server instance.