{"id":"CVE-2026-117548","kind":"vulnerability","aliases":["CVE-2026-117548"],"related":[],"title":"389 Directory Server: rename with schema alias crashes the server","description":"A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as \"commonName\") instead of its canonical name (such as \"cn\") as the new relative distinguished name. An authenticated attacker with the ModifyDN (rename) permission on the affected entry can use this flaw to crash the directory server, causing a denial of service.","summary":"A NULL pointer dereference in 389-ds-base happens when a ModifyDN (rename) request uses a schema alias such as \"commonName\" instead of the canonical attribute name \"cn\" as the new RDN. An authenticated user with rename permission on an entry can crash the directory server, causing a denial of service.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["389-ds-base","directory-server","ldap","runtime"],"not_affected_if":["no-untrusted-rename-permissions"],"how_to_check":"- Check the installed package version with `rpm -q 389-ds-base` or `dpkg -l 389-ds-base` and compare it to the fixed version.\n- Confirm whether untrusted or low-privilege accounts hold the ModifyDN (rename) permission on directory entries.","fix":null,"status":"open","published_at":"2026-10-29T07:16:44+00:00","first_seen_at":"2026-10-29T07:23:29+00:00","triaged_at":"2026-10-29T07:23:47+00:00","updated_at":"2026-10-29T07:23:47+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-29T07:23:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"389 Directory Server: rename with schema alias crashes the server","impact":"low","summary":"A NULL pointer dereference in 389-ds-base happens when a ModifyDN (rename) request uses a schema alias such as \"commonName\" instead of the canonical attribute name \"cn\" as the new RDN. An authenticated user with rename permission on an entry can crash the directory server, causing a denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["389-ds-base","ldap","directory-server"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Directory server crashes, causing denial of service for dependent services","analyst_note":"Find the affected and fixed 389-ds-base version ranges and any upstream patch from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-117548).","how_to_check":"- Check the installed package version with `rpm -q 389-ds-base` or `dpkg -l 389-ds-base` and compare it to the fixed version.\n- Confirm whether untrusted or low-privilege accounts hold the ModifyDN (rename) permission on directory entries.","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-rename-permissions"],"who_is_affected":"Teams running 389 Directory Server (389-ds-base) as an LDAP directory are exposed. The attacker must hold the ModifyDN (rename) permission on the affected entry, so deployments where only administrators can rename entries carry lower risk. The sources do not name affected version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000721,"input_tokens":4152,"output_tokens":612,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117548':13A,16A '-2026':12A,15A '389':1A,17B,31B,86C 'affect':132C 'alia':7A,44B,103C 'attack':124C 'attribut':52B,100C 'authent':60B,123C 'base':20B,34B,89C 'canon':51B,111C 'caus':73B,143C 'cn':54B,115C 'commonnam':47B,107C 'crash':8A,69B,139C 'cve':11A,14A 'denial':75B,145C 'derefer':29B,81C 'directori':2A,22B,71B,141C 'directory-serv':21B 'distinguish':120C 'ds':19B,33B,88C 'ds-base':18B,32B,87C 'entri':67B,133C 'flaw':82C,91C,137C 'found':84C 'happen':35B 'instead':48B,108C 'ldap':24B 'modifydn':38B,95C,127C 'name':53B,104C,112C,121C 'new':57B,118C 'null':27B,79C 'occur':92C 'oper':97C 'permiss':64B,129C 'pointer':28B,80C 'rdn':58B 'relat':119C 'renam':4A,39B,63B,96C,128C 'request':40B 'runtim':25B 'schema':6A,43B,102C 'server':3A,10A,23B,72B,142C 'servic':77B,147C 'use':41B,98C,135C 'user':61B","nicknames":[],"mitigations":[],"who_affected":"Teams running 389 Directory Server (389-ds-base) as an LDAP directory are exposed. The attacker must hold the ModifyDN (rename) permission on the affected entry, so deployments where only administrators can rename entries carry lower risk. The sources do not name affected version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T07:16:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117548","severity":null,"published_at":"2026-10-29T07:16:44+00:00","modified_at":"2026-10-29T07:16:44+00:00","first_seen_at":"2026-10-29T07:23:29+00:00","fetched_at":"2026-10-29T07:23:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}