389 DS PBKDF2 SHA256 Iteration Unbounded, CPU DoS Exploit
CVE-2026-11790 Published on June 9, 2026
389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service
A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.
Vulnerability Analysis
CVE-2026-11790 is exploitable with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Timeline
Reported to Red Hat.
Made public.
Weakness Type
What is a Resource Exhaustion Vulnerability?
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVE-2026-11790 has been classified to as a Resource Exhaustion vulnerability or weakness.
Products Associated with CVE-2026-11790
stack.watch emails you whenever new vulnerabilities are published in Red Hat Directory Server or Red Hat Enterprise Linux (RHEL). Just hit a watch button to start following.
