CVE-2026-11788 is a NULL pointer dereference vulnerability in the dereference control plugin BER parser of 389 Directory Server. The plugin does not check for allocation failure before using a BER structure, which can lead to a crash of the LDAP server under memory pressure conditions. This vulnerability allows an unauthenticated remote attacker to cause a denial of service. Red Hat has issued security advisories RHSA-2026:55421 and RHSA-2026:55422 providing patches in updated 389-ds-base packages for Red Hat Enterprise Linux 9.2 and 9.4 respectively.

The vulnerability results in a denial of service (DoS) condition by crashing the LDAP server. There is no confidentiality or integrity impact reported. The attack requires network access but no authentication. The CVSS score is 5.9 (medium), reflecting the DoS impact with high attack complexity.

Red Hat has released official security updates for 389-ds-base packages in Red Hat Enterprise Linux 9.2 and 9.4 that fix this vulnerability. Users should apply these updates promptly to remediate the issue. Refer to Red Hat's advisory and article https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigation is required beyond applying the vendor-provided patches.