Type Confusion Vulnerability in 389 Directory Server by Red Hat
CVE-2026-11785

4.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Directory Server 11
Red Hat Directory Server 12
Red Hat Directory Server 13
Red Hat Enterprise Linux 10
Vendor
CVE Published:
9 June 2026

What is CVE-2026-11785?

A type confusion flaw in the 389 Directory Server allows authenticated users to retrieve partial stack address information through LDAP responses. This vulnerability arises from improper handling of SSO token extended operation requests, potentially leading to unauthorized disclosure of sensitive data.

References

https://access.redhat.com/security/cve/CVE-2026-11785
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2485427
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.