A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Red Hat Red Hat Directory Server 11 affected —
Red Hat Red Hat Directory Server 12 affected —
Red Hat Red Hat Directory Server 13 affected —
Red Hat Red Hat Enterprise Linux 10 affected —
Red Hat Red Hat Enterprise Linux 6 unaffected —
Red Hat Red Hat Enterprise Linux 7 affected —
Red Hat Red Hat Enterprise Linux 8 affected —
Red Hat Red Hat Enterprise Linux 9 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Redhat Subscribe
Directory Server Subscribe
Enterprise Linux Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

Disable nsslapd-allow-hashed-passwords (default: off) to prevent non-DM users from setting pre-hashed passwords. Restrict Directory Manager credentials; limit DM access to management networks and audit DM operations via nsslapd-auditlog. Monitor for suspicious userPassword modifications (unusual hash schemes or large base64 payloads). Monitor for unusually long bind operations to the same account, which may indicate a poisoned PBKDF2 hash.

References
Link Providers
https://access.redhat.com/security/cve/CVE-2026-11790 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2485421 cve-icon cve-icon
https://redhat.atlassian.net/browse/PSIRTSUPT-7600 cve-icon cve-icon
History

Tue, 09 Jun 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 09 Jun 2026 13:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.
Title 389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service
First Time appeared Redhat
Redhat directory Server
Redhat enterprise Linux
Weaknesses CWE-400
CPEs cpe:/a:redhat:directory_server:11
cpe:/a:redhat:directory_server:12
cpe:/a:redhat:directory_server:13
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat directory Server
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-06-09T13:29:01.281Z

Reserved: 2026-06-09T13:00:11.043Z

Link: CVE-2026-11790

cve-icon Vulnrichment

Updated: 2026-06-09T13:28:57.873Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-06-09T14:16:37.197

Modified: 2026-06-09T14:42:21.530

Link: CVE-2026-11790

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-09T15:00:07Z

Weaknesses