# CVE-2026-11791: 389 Directory Server use-after-free in schema reload

Source: https://junglewise.ai/threats/cve-2026-11791-389-directory-server-use-after-free-in-schema-reload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-11791 · Severity: medium · CVSS 5 · Published 2026-06-18

389 Directory Server is an enterprise-grade LDAP server used for managing user identities and access. A flaw in how the server handles updates to its internal data structure (schema) can cause the system to crash if an administrator reloads the schema while the server is actively processing user queries. This results in a denial of service, potentially disrupting authentication and directory services for the entire organization.

## Quick answers

**Is CVE-2026-11791 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11791 being exploited in the wild.

**How severe is CVE-2026-11791?** Medium severity, with a CVSS score of 5, published 18 June 2026.

**Which products and versions are affected?** 389ds 389 Directory Server All versions with dynamic schema reload support; Red Hat Red Hat Directory Server 11; Red Hat Red Hat Directory Server 12; Red Hat Red Hat Directory Server 13; and 4 more.

**Is there a fix for CVE-2026-11791?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11791 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-11791?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in the 389 Directory Server's 'attr_syntax_swap_ht()' function within 'attrsyntax.c'. During a schema reload, this function unconditionally frees attribute syntax information nodes, bypassing the standard reference-counting mechanism used for deferred deletion. If an administrator triggers a schema reload (e.g., via 'dsconf' or LDAP modification) while concurrent LDAP queries are active, worker threads may attempt to access the freed memory. This race condition can result in a SIGSEGV crash (double-free or UAF). The vulnerability is present in versions supporting dynamic schema reload and requires administrative privileges to trigger the reload.

## Affected products

- 389ds 389 Directory Server All versions with dynamic schema reload support
- Red Hat Red Hat Directory Server 11
- Red Hat Red Hat Directory Server 12
- Red Hat Red Hat Directory Server 13
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10

## Timeline

- 2026-06-05: disclosed: Reported via Red Hat Bugzilla
- 2026-06-18: advisory: NVD and Red Hat published advisory details

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-11791](https://access.redhat.com/security/cve/CVE-2026-11791)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2485414](https://bugzilla.redhat.com/show_bug.cgi?id=2485414)
- [https://redhat.atlassian.net/browse/PSIRTSUPT-7600](https://redhat.atlassian.net/browse/PSIRTSUPT-7600)