Bug 2485423 (CVE-2026-11788) - CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser
Summary: CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref co...
Keywords:
Status: NEW
Alias: CVE-2026-11788
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-05 12:25 UTC by OSIDB Bzimport
Modified: 2026-06-09 12:58 UTC (History)
11 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-06-05 12:25:05 UTC 
The dereference control plugin in 389 Directory Server fails to check the return value of ber_init() for NULL before use in deref_parse_ctrl_value() (deref.c). When memory allocation fails under memory pressure, an unauthenticated LDAP client sending a search with the deref control can crash ns-slapd.

The deref plugin is enabled by default. Crash confirmed via GDB fault injection on Fedora 42 (SIGABRT) and CentOS 7 (SIGSEGV on OpenLDAP 2.4). Vulnerable code present since deref plugin introduction in 389-ds-base 1.2.6 (~2010).
Note You need to log in before you can comment on or make changes to this bug.