CVE-2026-11790 Details
Description
A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.
A denial-of-service vulnerability has been identified in 389 Directory Server versions 1.3.6 and later. The issue arises in the PBKDF2-SHA256 password storage plugin, which fails to impose a limit on the iteration count derived from stored password hashes. This flaw allows a privileged attacker with Directory Manager rights to inject a crafted PBKDF2 hash with an extremely high iteration count. When the modified hash is used during authentication, it can lead to excessive CPU usage, causing worker threads to hang for hours and disrupting service for legitimate users.
To mitigate this vulnerability, disable the 'nsslapd-allow-hashed-passwords' option to prevent non-Directory Manager users from setting pre-hashed passwords. It is also advisable to restrict Directory Manager access to management networks and monitor for unusual password hash modifications or extended bind operation times, which could indicate exploitation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-11790 | [email protected] | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2485421 | [email protected] | Issue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| redhat directory server | 11.0 12.0 13.0 |
CPE
Remediation
| |
| redhat 389 directory server | 1.3.6.0 |
CPE
Remediation
| |
| redhat enterprise linux | 7.0 8.0 9.0 10.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 30, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | Initial Analysis | [email protected] |
| Jun 9, 2026 | New CVE Received | [email protected] |