CVE-2026-11790

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-11790
A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2026-11790 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2485421 Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:directory_server:11.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:directory_server:12.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:directory_server:13.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:389_directory_server:1.3.6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
History

23 Jul 2026, 08:10

Type Values Removed Values Added
Summary
  • (es) Se encontró un fallo en 389 Directory Server. El plugin de almacenamiento de contraseñas PBKDF2-SHA256 no impone un límite superior en el recuento de iteraciones extraído de los hashes de contraseñas almacenados. Un atacante privilegiado que puede modificar el hash de la contraseña de un usuario puede causar un consumo excesivo de CPU durante la autenticación, lo que provoca una denegación de servicio.

30 Jun 2026, 14:16

Type Values Removed Values Added
References
  • {'url': 'https://redhat.atlassian.net/browse/PSIRTSUPT-7600', 'tags': ['Permissions Required'], 'source': 'secalert@redhat.com'}

12 Jun 2026, 18:21

Type Values Removed Values Added
References () https://access.redhat.com/security/cve/CVE-2026-11790 - () https://access.redhat.com/security/cve/CVE-2026-11790 - Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2485421 - () https://bugzilla.redhat.com/show_bug.cgi?id=2485421 - Issue Tracking, Vendor Advisory
References () https://redhat.atlassian.net/browse/PSIRTSUPT-7600 - () https://redhat.atlassian.net/browse/PSIRTSUPT-7600 - Permissions Required
First Time Redhat directory Server
Redhat enterprise Linux
Redhat 389 Directory Server
Redhat
CPE cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:directory_server:12.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:389_directory_server:1.3.6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:directory_server:11.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:directory_server:13.0:*:*:*:*:*:*:*

09 Jun 2026, 14:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-09 14:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-11790

Mitre link : CVE-2026-11790

CVE.ORG link : CVE-2026-11790

JSON object : View

Products Affected

redhat

  • directory_server
  • 389_directory_server
  • enterprise_linux
CWE
CWE-400

Uncontrolled Resource Consumption