CVE-2026-11791 389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht()

Medium 5.0 Published 18 Jun 2026 Updated 30 Jun 2026

An attacker or administrator triggering schema reload during concurrent LDAP traffic can cause a use-after-free, leading to server crash and denial of service.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-11791?

CVE-2026-11791 is a medium-severity use after free vulnerability in Redhat Enterprise Linux, published on 18 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function unconditionally frees attribute syntax information nodes, bypassing the refcount-based deferred deletion used elsewhere in the attribute syntax subsystem. If an administrator triggers schema reload while concurrent LDAP query traffic is active, worker threads may access freed memory, resulting in use-after-free or double-free and a denial of service (server crash).

Weakness: CWE-416

Which versions are affected by CVE-2026-11791?

It affects 3 products.

Products include Redhat 389 Directory Server, Redhat Directory Server, Redhat Enterprise Linux.

How do I fix CVE-2026-11791?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-11791 being exploited?

There is no known exploitation of CVE-2026-11791 in the wild and no public exploit code.

All Redhat Enterprise Linux vulnerabilities

Sources

Also known as AZL-90206, DEBIAN-CVE-2026-11791, GHSA-gxp7-cx54-gr2m, UBUNTU-CVE-2026-11791.