This vulnerability involves uncontrolled resource consumption in the 389 Directory Server component of Red Hat Directory Server 11. Specifically, the PBKDF2-SHA256 password storage plugin fails to enforce an upper bound on the iteration count extracted from stored password hashes. An attacker with privileged access capable of modifying password hashes can exploit this to cause excessive CPU consumption during authentication attempts, resulting in denial of service. The CVSS 3.1 base score is 4.9 (medium), reflecting network attack vector, low attack complexity, required high privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. No patch or official fix is currently documented in the vendor advisory.

The vulnerability allows a privileged attacker to cause excessive CPU consumption on the authentication server by manipulating the iteration count in password hashes. This can lead to denial of service conditions affecting availability. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-11790 for current remediation guidance. Until a fix is available, limit privileged access to password hashes to prevent exploitation. Monitor Red Hat communications for updates.