Skip to main content

Severity by source

Vendor (redhat) PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Network-reachable unauthenticated path (AV:N/PR:N) but AC:H because reliable heap corruption requires specific allocator state; availability-only impact with no scope change.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 12, 2026 - 10:01 vuln.today
CVE Published
Aug 12, 2026 - 09:35 cve.org
MEDIUM 5.9

DescriptionCVE.org

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPI_REQCONTROLS pblock slot. Operation teardown then frees the same pointer again, causing a double-free. An unauthenticated remote attacker can trigger this with a single BIND request carrying a critical Session Tracking control, resulting in heap corruption and potential denial of service.

AnalysisAI

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash the directory service with a single crafted BIND request. The flaw resides in get_ldapmessage_controls_ext(), which frees a parsed controls array when rejecting an unknown critical Session Tracking control but fails to clear the corresponding SLAPI_REQCONTROLS pblock slot - causing operation teardown to free the same pointer a second time. Affected deployments include Red Hat Directory Server 11 through 13 and the 389-ds-base package across all supported RHEL versions (6-10). No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS AC:H rating reflects that reliable heap exploitation requires specific memory layout conditions rather than a trivially repeatable one-shot crash.

Technical ContextAI

389-ds-base is the upstream open-source LDAP directory server that underpins Red Hat Directory Server and ships as the default LDAP service in Red Hat Enterprise Linux. LDAP controls (RFC 4511 §4.1.11) are optional extensions attached to any LDAP request; a control marked 'critical' must be understood and processed by the server or the operation must be rejected per RFC 3672. The affected code path in get_ldapmessage_controls_ext() handles this mandatory rejection for the LDAP Session Tracking control (draft-wahl-ldap-session). CWE-415 (Double Free) describes the root cause: the function frees the dynamically allocated controls array on the rejection path but does not NULL-out or clear the SLAPI_REQCONTROLS slot in the pblock (389-ds's central parameter block structure used to carry state through the request lifecycle). When the operation's teardown routine later iterates the pblock to release resources, it encounters the already-freed pointer and attempts a second free, corrupting the glibc heap allocator metadata. On modern RHEL systems with heap hardening (glibc tcache protections, ASLR), this most realistically manifests as a SIGABRT crash of the ns-slapd process (denial of service), though heap corruption primitives can in theory be chained further. CPE data confirms affected products: cpe:2.3:a:red_hat:red_hat_directory_server_11 through _13 and cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through _10.

RemediationAI

The primary remediation is to apply the Red Hat errata package update for 389-ds-base once Red Hat publishes it via their security advisory at https://access.redhat.com/security/cve/CVE-2026-18663; no specific fixed version number is available in the current data set so monitor that advisory and the Bugzilla entry (https://bugzilla.redhat.com/show_bug.cgi?id=2510631) for the patched RPM version. Until a patch is available, the most effective compensating control is to restrict LDAP access (TCP 389 and LDAPS 636) using host-based firewalls (firewalld/iptables) or network ACLs to only trusted client IP ranges, preventing unauthenticated external actors from delivering the malicious BIND request; this does not eliminate risk from compromised internal hosts. A second option is to configure the directory server's access control to require a client certificate for BIND operations (TLS mutual authentication), which adds an authentication gate before the vulnerable code path is reachable - the trade-off is operational overhead for certificate management. Disabling the Session Tracking control support at the plugin level, if 389-ds exposes such a configuration knob, would eliminate the vulnerable rejection path entirely but should be tested for compatibility with directory clients that may rely on it.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-86345 CRITICAL
9.0 Oct 01

StartTLS handling in 389-ds-base does not discard plaintext bytes buffered before the TLS upgrade, allowing an on-path a

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected

Share

CVE-2026-18663 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy