{"api_version":"1","generated_at":"2026-10-29T09:22:11+00:00","cve":"CVE-2026-117548","urls":{"html":"https://cve.report/CVE-2026-117548","api":"https://cve.report/api/cve/CVE-2026-117548.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-117548","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-117548"},"summary":{"title":"389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service","description":"A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as \"commonName\") instead of its canonical name (such as \"cn\") as the new relative distinguished name. An authenticated attacker with the ModifyDN (rename) permission on the affected entry can use this flaw to crash the directory server, causing a denial of service.","state":"PUBLISHED","assigner":"redhat","published_at":"2026-10-29 07:16:44","updated_at":"2026-10-29 07:16:44"},"problem_types":["CWE-476","CWE-476 NULL Pointer Dereference"],"metrics":[{"version":"3.1","source":"secalert@redhat.com","type":"Primary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-117548","name":"https://access.redhat.com/security/cve/CVE-2026-117548","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2561778","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2561778","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-117548","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117548","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Red Hat","product":"Red Hat Directory Server 11","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Directory Server 12","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Directory Server 13","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","version":"","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-10-25T00:00:00.000Z","lang":"en","value":"Reported to Red Hat."},{"source":"CNA","time":"2026-10-27T11:08:00.000Z","lang":"en","value":"Made public."}],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"Administrators should review custom access control instructions (ACIs) and avoid granting the ModifyDN (rename) right to non-administrative principals unless specifically required. Restricting this right reduces exposure to this issue until a fixed package is available. Neither 389-ds-base's own default ACI templates nor Red Hat Identity Management (IdM/FreeIPA)'s default ACIs grant this right to non-administrative users, so deployments that have not customized their ACIs are not exposed.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Red Hat would like to thank Chad Sikorra for reporting this issue.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:directory_server:11"],"defaultStatus":"affected","packageName":"redhat-ds:11/389-ds-base","product":"Red Hat Directory Server 11","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:directory_server:12"],"defaultStatus":"affected","packageName":"redhat-ds:12/389-ds-base","product":"Red Hat Directory Server 12","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:directory_server:13"],"defaultStatus":"affected","packageName":"389-ds-base","product":"Red Hat Directory Server 13","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"389-ds-base","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unknown","packageName":"389-ds-base","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"affected","packageName":"389-ds-base","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"389-ds:1.4/389-ds-base","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"389-ds-base","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"credits":[{"lang":"en","value":"Red Hat would like to thank Chad Sikorra for reporting this issue."}],"datePublic":"2026-10-27T11:08:00.000Z","descriptions":[{"lang":"en","value":"A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as \"commonName\") instead of its canonical name (such as \"cn\") as the new relative distinguished name. An authenticated attacker with the ModifyDN (rename) permission on the affected entry can use this flaw to crash the directory server, causing a denial of service."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Moderate"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-476","description":"NULL Pointer Dereference","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-29T06:22:06.328Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-117548"},{"name":"RHBZ#2561778","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2561778"}],"timeline":[{"lang":"en","time":"2026-10-25T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-10-27T11:08:00.000Z","value":"Made public."}],"title":"389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service","workarounds":[{"lang":"en","value":"Administrators should review custom access control instructions (ACIs) and avoid granting the ModifyDN (rename) right to non-administrative principals unless specifically required. Restricting this right reduces exposure to this issue until a fixed package is available. Neither 389-ds-base's own default ACI templates nor Red Hat Identity Management (IdM/FreeIPA)'s default ACIs grant this right to non-administrative users, so deployments that have not customized their ACIs are not exposed."}],"x_generator":{"engine":"cvelib 1.8.0"},"x_redhatCweChain":"CWE-476: NULL Pointer Dereference"}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2026-117548","datePublished":"2026-10-29T06:22:06.328Z","dateReserved":"2026-10-27T11:07:52.303Z","dateUpdated":"2026-10-29T06:22:06.328Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-29 07:16:44","lastModifiedDate":"2026-10-29 07:16:44","problem_types":["CWE-476","CWE-476 NULL Pointer Dereference"],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"117548","Ordinal":"1","Title":"389-ds-base: 389-ds-base: null pointer dereference via modifydn ","CVE":"CVE-2026-117548","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"117548","Ordinal":"1","NoteData":"A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as \"commonName\") instead of its canonical name (such as \"cn\") as the new relative distinguished name. An authenticated attacker with the ModifyDN (rename) permission on the affected entry can use this flaw to crash the directory server, causing a denial of service.","Type":"Description","Title":"389-ds-base: 389-ds-base: null pointer dereference via modifydn "}]}}}