The vulnerability in Red Hat Directory Server 11 arises from the Content Synchronization persistent search plugin, which permits unbounded memory growth if an authenticated client ceases to read synchronization responses. This uncontrolled resource consumption can cause denial of service. Furthermore, race conditions in the plugin's thread lifecycle can result in crashes during connection teardown or shutdown. The CVSS 3.1 base score is 6.5 (medium severity), with network attack vector, low attack complexity, requiring low privileges and no user interaction, impacting availability only. The vendor advisory does not specify a remediation or patch status.

The primary impact is a denial of service condition caused by unbounded memory growth when an authenticated client stops reading sync responses, potentially exhausting server resources. Additionally, race conditions may cause server crashes during connection teardown or shutdown, further affecting availability. There is no impact on confidentiality or integrity reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-11611 for current remediation guidance. Until an official fix is available, consider limiting authenticated client access to the Content Synchronization persistent search plugin or monitoring resource usage to detect abnormal memory growth. Avoid relying on generic mitigations not directly related to this vulnerability.