NULL Pointer Dereference Vulnerability in 389-ds-base by Red Hat
CVE-2026-117548

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Directory Server 11
Red Hat Directory Server 12
Red Hat Directory Server 13
Red Hat Enterprise Linux 10
Vendor
CVE Published:
29 October 2026

What is CVE-2026-117548?

A NULL pointer dereference vulnerability exists in 389-ds-base, triggered when an attribute's schema alias name is used instead of its canonical name during a ModifyDN (rename) operation. This flaw enables an authenticated attacker with the necessary permissions to rename entries to exploit the vulnerability, potentially crashing the directory server and leading to denial of service.

References

https://access.redhat.com/security/cve/CVE-2026-117548
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2561778
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Chad Sikorra for reporting this issue.
.