CVE-2026-11611

6.5 mediumEPSS 0.2%

Medium (6.5) in redhat. EPSS 0.2% chance of exploitation in the next 30 days.

A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses, enabling denial of service. Additional race conditions in plugin thread lifecycle can cause crashes during connection teardown or shutdown.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
CWE: CWE-400
Published: 2026-06-08
Modified: 2026-07-23
Record from: the NVD, synced 2026-10-19

Affected

redhat:389_directory_server
redhat:directory_server
redhat:enterprise_linux

References

https://access.redhat.com/security/cve/CVE-2026-11611
https://bugzilla.redhat.com/show_bug.cgi?id=2485424

Check your stack JSON