CVE-2026-11611 389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions

What is CVE-2026-11611?

CVE-2026-11611 is a medium-severity denial of service vulnerability in Redhat Enterprise Linux, published on 8 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses, enabling denial of service. Additional race conditions in plugin thread lifecycle can cause crashes during connection teardown or shutdown.

Weakness: CWE-400

Which versions are affected by CVE-2026-11611?

It affects 3 products.

Products include Redhat 389 Directory Server, Redhat Directory Server, Redhat Enterprise Linux.

How do I fix CVE-2026-11611?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-11611 being exploited?

There is no known exploitation of CVE-2026-11611 in the wild and no public exploit code.

Other vulnerabilities in Redhat Enterprise Linux

• CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check High 7.5
• CVE-2026-15722 Memory corruption in Red Hat Directory Server 11.5 E4S for RHEL 8 High 7.5
• CVE-2026-9064 Denial of service in Red Hat Directory Server 11.5 E4S for RHEL 8 High 7.5
• CVE-2010-2222 Null dereference in Red Hat Directory Server High 7.5
• CVE-2024-6237 389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request Medium 6.5

All Redhat Enterprise Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-11611, GHSA-m7g9-hmx3-c8f9, UBUNTU-CVE-2026-11611.