Title: varios productos de Red Hat, Description: Se encontró una vulnerabilidad en 389 Directory Server. El plugin de búsqueda persistente de sincronización de contenido permite un crecimiento ilimitado de la memoria cuando un cliente autenticado deja de leer las respuestas de sincronización, lo que permite la denegación de servicio. Condiciones de carrera adicionales en el ciclo de vida de los hilos del plugin pueden causar fallos durante el cierre de la conexión o el apagado.

https://redhat.atlassian.net/browse/PSIRTSUPT-7600

https://redhat.atlassian.net/browse/PSIRTSUPT-7600 Types: Permissions Required

{"timestamp":"2026-06-09T14:28:50.963949Z","id":"CVE-2026-11611","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Red Hat","product":"Red Hat Directory Server 11","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"redhat-ds:11/389-ds-base","cpes":["cpe:/a:redhat:directory_server:11"]},{"vendor":"Red Hat","product":"Red Hat Directory Server 12","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"redhat-ds:12/389-ds-base","cpes":["cpe:/a:redhat:directory_server:12"]},{"vendor":"Red Hat","product":"Red Hat Directory Server 13","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"389-ds-base","cpes":["cpe:/a:redhat:directory_server:13"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"389-ds-base","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"389-ds-base","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"389-ds-base","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"389-ds-base","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"389-ds-base","cpes":["cpe:/o:redhat:enterprise_linux:9"]}]

OR
          *cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:389_directory_server:-:*:*:*:*:*:*:*
          *cpe:2.3:a:redhat:directory_server:11.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
          *cpe:2.3:a:redhat:directory_server:12.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
          *cpe:2.3:a:redhat:directory_server:13.0:*:*:*:*:*:*:*

Red Hat, Inc.: https://access.redhat.com/security/cve/CVE-2026-11611 Types: Vendor Advisory

Red Hat, Inc.: https://bugzilla.redhat.com/show_bug.cgi?id=2485424 Types: Issue Tracking, Vendor Advisory

Red Hat, Inc.: https://redhat.atlassian.net/browse/PSIRTSUPT-7600 Types: Permissions Required

A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses, enabling denial of service. Additional race conditions in plugin thread lifecycle can cause crashes during connection teardown or shutdown.

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-400

https://access.redhat.com/security/cve/CVE-2026-11611

https://bugzilla.redhat.com/show_bug.cgi?id=2485424

https://redhat.atlassian.net/browse/PSIRTSUPT-7600