Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2026-11790

Опубликовано: 09 июн. 2026
Источник: nvd
CVSS3: 4.9
EPSS Низкий

Описание

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redhat:directory_server:11.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:directory_server:12.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:directory_server:13.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:389_directory_server:1.3.6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 22%
0.00291
Низкий

4.9 Medium

CVSS3

Дефекты

CWE-400

Связанные уязвимости

CVSS3: 4.9
ubuntu
2 месяца назад

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

CVSS3: 4.9
redhat
4 месяца назад

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

CVSS3: 4.9
debian
2 месяца назад

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password s ...

CVSS3: 4.9
github
2 месяца назад

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

suse-cvrf
30 дней назад

Security update for 389-ds

EPSS

Процентиль: 22%
0.00291
Низкий

4.9 Medium

CVSS3

Дефекты

CWE-400