Use-After-Free Vulnerability in 389 Directory Server by Red Hat
CVE-2026-11791

5MEDIUM

Key Information:

Vendor: Red Hat
Status: Red Hat Directory Server 11; Red Hat Directory Server 12; Red Hat Directory Server 13; Red Hat Enterprise Linux 10
Vendor: CVE Published:; 18 June 2026

What is CVE-2026-11791?

A vulnerability exists in 389 Directory Server that leads to potential memory access issues during schema reloading. In the attr_syntax_swap_ht() function, a flaw allows for the unconditional freeing of attribute syntax information nodes. During periods of concurrent LDAP query traffic, if an administrator triggers a schema reload, worker threads might attempt to access freed memory. This could result in memory corruption issues, manifesting as use-after-free or double-free scenarios, leading to server crashes and potential denial of service.