CVE-2026-11791

Name of the Vulnerable Software and Affected Versions 389 Directory Server (affected versions not specified)

Description A flaw exists during schema reload where the attr syntax swap ht() function unconditionally frees attribute syntax information nodes. This action bypasses the refcount-based deferred deletion mechanism used in the attribute syntax subsystem. If a schema reload is triggered while concurrent LDAP query traffic is active, worker threads may access freed memory, leading to a use-after-free or double-free condition, which results in a denial of service via a server crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.