This vulnerability in Red Hat Directory Server 11 arises from improper memory management in the attr_syntax_swap_ht() function during schema reload. The function frees attribute syntax information nodes directly, ignoring the reference counting system designed to defer deletion safely. Concurrent LDAP queries during schema reload may cause worker threads to access memory that has already been freed, resulting in use-after-free or double-free conditions. This can cause the server to crash, leading to denial of service. The CVSS 3.1 base score is 5.0, reflecting medium severity with network attack vector, high attack complexity, and requirement for high privileges.

Successful exploitation can cause denial of service by crashing the Red Hat Directory Server. There is no indication of confidentiality or integrity impact. The vulnerability requires an administrator to trigger schema reload while LDAP queries are active, and the attacker must have high privileges to initiate this condition.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-11791 for current remediation guidance. Until a fix is available, avoid triggering schema reload concurrently with active LDAP query traffic to prevent use-after-free conditions.