Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Connect to LDAP port TCP 389/636
  2. Delivery
    Send paged-results search request with USE_ONE_BACKEND control
  3. Exploit
    Trigger NULL dereference in op_shared_search
  4. Execution
    389-ds process crashes
  5. Impact
    LDAP service unavailable, all dependent auth fails

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires network-level access to the target's LDAP port (TCP 389 for cleartext or TCP 636 for TLS). No authentication is required - confirmed by the CVSS PR:N metric. The attack specifically requires sending a crafted search request that combines the RFC 2696 paged results control with the USE_ONE_BACKEND control; generic LDAP search requests do not trigger the flaw. The vulnerability is exploitable against default 389 Directory Server deployments without any non-standard configuration on the victim side. Exploitation is limited strictly to denial of service (process crash); the flaw cannot be used for remote code execution, data exfiltration, or privilege escalation. LDAP services restricted to internal or management networks via firewall rules are not reachable from external attackers.
Impact

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects the threat model: network-reachable, requires no credentials, low attack complexity, and delivers full availability impact. In practice, crashing the LDAP server in an enterprise environment has cascading consequences - all services relying on directory authentication (SSH, sudo, web SSO, PAM) will fail until the service is restarted. The low complexity and zero authentication requirement mean the attack is automatable and repeatable, enabling a persistent DoS pattern. Impact is strictly limited to availability (C:N/I:N); no data exfiltration or privilege escalation is possible via this path. No EPSS data was provided, and no KEV listing or confirmed public POC exists at time of analysis, which tempers urgency slightly - but the trivial exploit conditions and high operational impact in directory-dependent environments make this a genuine patching priority for Red Hat shops. LDAP services exposed to untrusted or internet-facing networks are at elevated risk.
Exploit ScenarioDerived

An attacker with network access to TCP port 389 (or 636) scripted an LDAP client to send a crafted sequence of search requests that activate both the paged results control and the USE_ONE_BACKEND control in a specific order, causing op_shared_search to dereference a NULL pointer and crash the 389-ds process. The server goes offline immediately, taking with it all PAM/SSSD authentication, sudo lookups, and SSO sessions in the affected environment. The attacker can repeat the request sequence each time the service is restarted to maintain a persistent denial-of-service condition with no credentials required.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 07, 2026

Unauthenticated remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13) allows a network attacker to crash the LDAP server by sending a crafted sequence of search requests that combine the paged results control with the USE_ONE_BACKEND control, triggering a NULL pointer dereference in op_shared_search. The crash terminates the directory service process, disrupting all LDAP-dependent services such as authentication, authorization, and group resolution until manually restarted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector makes automated, repeated disruption straightforward.

RemediationAI

Apply the Red Hat errata package for the applicable Red Hat Directory Server release (11, 12, or 13) or the 389-ds-base package update for the installed RHEL version (6-10), as published via https://access.redhat.com/security/cve/CVE-2026-18453. Specific fixed package version numbers are not confirmed in the available data - consult the Red Hat Customer Portal errata page for the exact RPM version to target. As an immediate compensating control, restrict access to LDAP ports (TCP 389 and 636) using host-based or network firewall rules to trusted client subnets only, which prevents unauthenticated remote exploitation from untrusted networks. If operationally feasible, disabling the paged results control in the directory server configuration may also eliminate the vulnerable code path, though this will break any LDAP clients that depend on result pagination. Neither compensating control is a substitute for patching.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

389 Directory Server is an open-source, LDAPv3-compliant directory server that underpins Red Hat Enterprise Linux's identity management stack (IdM/FreeIPA). The vulnerable code path resides in op_shared_search, the shared handler for LDAP search operations. RFC 2696 defines the paged results control, which allows clients to retrieve large result sets incrementally; the USE_ONE_BACKEND control is a server-side optimization that pins a search to a single backend instance. CWE-476 (NULL Pointer Dereference) identifies the root cause: when paged results processing is combined with USE_ONE_BACKEND in a specific sequence, a code path in the paging logic dereferences a pointer that has not been validated as non-NULL, causing an immediate process crash. Affected CPEs span Red Hat Directory Server 11, 12, and 13, and the 389-ds-base package shipped across RHEL 6 through 10.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Unauthenticated network crash via crafted LDAP control sequence; no confidentiality or integrity impact, only full availability loss on crash.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat 7.5 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.

Executive ViewAI

Why It Matters

Red Hat Directory Server versions 11, 12, and 13 are vulnerable to a remote, unauthenticated denial-of-service attack that crashes the LDAP service, disrupting authentication and authorization for the entire organization. The vulnerability's network accessibility and ease of exploitation (AV:N/AC:L/PR:N) mean any external attacker can repeatedly trigger outages that disable identity services until manual intervention occurs.

Business Impact: High
Compensating Controls

Until a vendor patch is released, implement rate limiting on LDAP search requests to throttle attack attempts, disable or restrict the paged results control in client configurations, deploy process monitoring with automatic service restart on crash, restrict inbound network access to LDAP ports (389/636) to trusted client subnets, and maintain documented runbooks for rapid manual restart during incidents.

Threat Intelligence Overview

EPSS Score
0.8%
Top 44% exploitable
Prevalence
High
Core LDAP server across Red Hat enterprise Linux deployments
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.8%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_directory_server_11:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_directory_server_12:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_directory_server_13:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-18453 ADVISORY https://vuldb.com/vuln/399607 REF https://access.redhat.com/errata/RHSA-2026:64771 REF https://access.redhat.com/errata/RHSA-2026:64776 REF https://access.redhat.com/errata/RHSA-2026:64778 REF https://access.redhat.com/errata/RHSA-2026:64779 REF https://access.redhat.com/errata/RHSA-2026:64780 REF https://access.redhat.com/errata/RHSA-2026:64781 REF https://access.redhat.com/errata/RHSA-2026:64783 REF https://access.redhat.com/errata/RHSA-2026:64784 REF https://access.redhat.com/errata/RHSA-2026:64785 REF https://access.redhat.com/errata/RHSA-2026:64789 REF https://access.redhat.com/errata/RHSA-2026:64790 REF https://access.redhat.com/errata/RHSA-2026:64791 REF https://access.redhat.com/errata/RHSA-2026:64792 REF https://access.redhat.com/errata/RHSA-2026:64793 REF https://access.redhat.com/errata/RHSA-2026:64804 REF https://access.redhat.com/errata/RHSA-2026:65119 REF https://access.redhat.com/errata/RHSA-2026:79217 REF https://access.redhat.com/security/cve/CVE-2026-18453 REF https://bugzilla.redhat.com/show_bug.cgi?id=2509696

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy