DEBIAN-CVE-2026-11611

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-11611

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-11611.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-11611

Upstream

CVE-2026-11611

Published

2026-06-08T17:16:40Z

Modified

2026-09-14T17:01:26Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses, enabling denial of service. Additional race conditions in plugin thread lifecycle can cause crashes during connection teardown or shutdown.

References

https://security-tracker.debian.org/tracker/CVE-2026-11611

Affected packages

Debian:12 / 389-ds-base

Package

Name: 389-ds-base
Purl: pkg:deb/debian/389-ds-base?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.3.1+dfsg1-1

2.3.1+dfsg1-1+deb12u1

2.3.4+dfsg1-1

2.3.4+dfsg1-1.1

2.4.4+dfsg1-1

2.4.4+dfsg1-3

2.4.5+dfsg1-1

3.*

3.0.2+dfsg1-1

3.1.1+dfsg1-1

3.1.1+dfsg1-2

3.1.1+dfsg1-3

3.1.2+dfsg1-1

3.1.2+vendor1-1

3.1.2+vendor1-2

3.3.0-1

3.3.0-2

3.3.1-1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-11611.json"

Debian:13 / 389-ds-base