The vulnerability in Red Hat Directory Server 11 involves the Content Synchronization persistent search plugin allowing uncontrolled resource consumption. Specifically, when an authenticated client ceases to read synchronization responses, memory usage grows without bound, potentially causing denial of service. Furthermore, race conditions in the plugin's thread lifecycle can result in crashes during connection teardown or shutdown sequences. The CVSS 3.1 score is 6.5 (medium severity) with network attack vector, low attack complexity, requiring low privileges and no user interaction, impacting availability only.

The vulnerability can cause denial of service by exhausting server memory resources due to unbounded memory growth when sync responses are not read by an authenticated client. Crashes may also occur due to race conditions in plugin thread management, potentially disrupting service availability. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-11611 for current remediation guidance. No official fix or workaround is explicitly stated in the provided data. Until a patch is available, monitoring for abnormal resource usage related to the Content Synchronization plugin and limiting authenticated client access to trusted users may reduce risk.