Executive Summary

CVE-2026-11791 is a use-after-free vulnerability in the 389 Directory Server that occurs during schema reload operations.

The problem arises because the function attr_syntax_swap_ht() unconditionally frees attribute syntax information nodes without using the usual reference-count-based deferred deletion method employed elsewhere in the code.

If an administrator triggers a schema reload while LDAP queries are actively running, worker threads may try to access memory that has already been freed, leading to use-after-free or double-free errors.

This can cause the server to crash due to segmentation faults (SIGSEGV).

The vulnerability is related to a race condition during schema reload and is exacerbated by a memory leak in another function that mishandles reference counts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a denial of service (DoS) condition by causing the 389 Directory Server to crash.

If an attacker or administrator triggers a schema reload while LDAP queries are active, the server may experience use-after-free or double-free errors, resulting in worker threads accessing invalid memory.

The resulting crashes can disrupt directory services, potentially impacting authentication, authorization, and other LDAP-dependent operations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for crashes or SIGSEGV errors in the 389 Directory Server during schema reload operations while LDAP queries are active.

To reproduce or detect the issue, an administrator can trigger a schema reload using the command `dsconf schema reload` or by modifying the LDAP schema at `cn=schema,cn=config` while concurrent LDAP queries are running.

Using environment variable `MALLOC_PERTURB_=170` during testing can help in controlled reproduction of the use-after-free condition.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves avoiding triggering schema reload operations while LDAP query traffic is active, as the vulnerability occurs during concurrent schema reload and LDAP queries.

Administrators should apply any available patches or updates that address this issue once released, as the flaw is due to improper memory management in the `attr_syntax_swap_ht()` function.

Until a fix is applied, schedule schema reloads during maintenance windows with minimal or no LDAP query activity to prevent server crashes.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0