Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.3
CVE-2026-11792: 389 Directory Server password logging can corrupt system memory
CVE-2026-11792 · published 4 months ago
Summary
A security issue in 389 Directory Server can cause system memory to become corrupted when logging passwords, potentially leading to unpredictable system behavior. This issue is more likely to occur if the system is configured to store passwords in a non-standard way or if a trusted replication peer has been compromised. To mitigate this issue, administrators should ensure that audit logging is properly configured and consider upgrading to a fixed version of the software.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | 389-ds-base | All versions |
| Debian:12 | debian | 389-ds-base | All versions |
| Debian:13 | debian | 389-ds-base | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | 389-ds-base | All versions |
Original advisory text
A heap buffer overflow flaw was found in 389 Directory Server. When audit logging is enabled, the create_masked_entry_string() function in auditlog.c copies a fixed-length password mask into a prec...
A heap buffer overflow flaw was found in 389 Directory Server. When audit logging is enabled, the create_masked_entry_string() function in auditlog.c copies a fixed-length password mask into a precisely-sized heap buffer without checking available space. If a short cleartext password is logged (requiring non-default CLEAR password storage or a compromised replication peer), the copy overflows the buffer, corrupting heap memory and audit log output.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2484915 Third Party Advisory
- https://access.redhat.com/errata/RHBA-2025:15534 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-11792 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-11792 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-11792 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-11792 Third Party Advisory
- https://redhat.atlassian.net/browse/PSIRTSUPT-7600 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published9 Jun 2026
Updated4 Nov 2026
First seen9 Jun 2026
Track software like this
Free during beta