Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
8 versions affected across 3 products
CVE-2026-11790 Denial of Service via Unbounded Iteration Count in 389 Directory Server PBKDF2-SHA256 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-11790
Post summary
The entry announces CVE-2026-11790, a Denial of Service vulnerability in 389 Directory Server caused by an unbounded iteration count in PBKDF2-SHA256, with no PoC, exploit, or patch referenced.
8 of 8 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | redhat | 389_directory_server | 1.3.6.0 | - | - |
| App | redhat | directory_server | 11.0 | - | - |
| App | redhat | directory_server | 12.0 | - | - |
| App | redhat | directory_server | 13.0 | - | - |
| OS | redhat | enterprise_linux | 10.0 | - | - |
| OS | redhat | enterprise_linux | 7.0 | - | - |
| OS | redhat | enterprise_linux | 8.0 | - | - |
| OS | redhat | enterprise_linux | 9.0 | - | - |