---
id: "CVE-2026-117548"
kind: "vulnerability"
aliases: ["CVE-2026-117548"]
title: "389 Directory Server: rename with schema alias crashes the server"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["389-ds-base", "directory-server", "ldap", "runtime"]
not_affected_if: ["no-untrusted-rename-permissions"]
published_at: "2026-10-29T07:16:44+00:00"
first_seen_at: "2026-10-29T07:23:29+00:00"
updated_at: "2026-10-29T07:23:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117548", "first_seen_at": "2026-10-29T07:23:29+00:00"}]
---

# 389 Directory Server: rename with schema alias crashes the server

A NULL pointer dereference in 389-ds-base happens when a ModifyDN (rename) request uses a schema alias such as "commonName" instead of the canonical attribute name "cn" as the new RDN. An authenticated user with rename permission on an entry can crash the directory server, causing a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed package version with `rpm -q 389-ds-base` or `dpkg -l 389-ds-base` and compare it to the fixed version.
- Confirm whether untrusted or low-privilege accounts hold the ModifyDN (rename) permission on directory entries.

## Timeline

- 2026-10-29T07:23:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117548

## From the sources

A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as "commonName") instead of its canonical name (such as "cn") as the new relative distinguished name. An authenticated attacker with the ModifyDN (rename) permission on the affected entry can use this flaw to crash the directory server, causing a denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_