Medium severity · published Oct 29, 2026
CVE-2026-117548
389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service
New
6.5
CVSS
–
EPSS
No
On KEV
Description
A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as "commonName") instead of its canonical name (such as "cn") as the new relative distinguished name. An authenticated attacker with the ModifyDN (rename) permission on the affected entry can use this flaw to crash the directory server, causing a denial of service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Directory Server 11 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Directory Server 12 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Directory Server 13 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117548
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117548
vdb-entry
https://access.redhat.com/security/cve/CVE-2026-117548
issue-tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2561778
More from Red Hat Directory Server 11
9.0
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result
8.4
CVE-2026-19843
389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor
7.5
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue
7.5
CVE-2026-76560
389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn
6.5
CVE-2026-78701
389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos