CVE-2026-11785

NameCVE-2026-11785
DescriptionA flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1139810

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
389-ds-base (PTS)bookworm2.3.1+dfsg1-1+deb12u1vulnerable
trixie3.1.2+dfsg1-1+deb13u1vulnerable
sid3.3.1-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
389-ds-basesource(unstable)3.3.1-11139810

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2485427
Search for package or bug name: Reporting problems