Skip to main content

389 Directory Server CVE-2026-9064

| EUVDEUVD-2026-31079 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-05-20 secalert@redhat.com GHSA-7r3c-wfgh-x96c
7.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
Analysis Generated
May 20, 2026 - 10:31 vuln.today

DescriptionCVE.org

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.

AnalysisAI

Denial of service in 389-ds-base LDAP server allows remote unauthenticated attackers to exhaust CPU and heap memory by sending a single LDAP request packed with hundreds of thousands of minimal controls. Because get_ldapmessage_controls_ext() does not cap the per-message control count, the 2 MB default BER message limit is the only ceiling, and concurrent abuse causes worker thread starvation or OOM termination. No public exploit identified at time of analysis, and the issue is not on CISA KEV.

Technical ContextAI

389 Directory Server (389-ds-base) is the open-source LDAP v3 directory server maintained by Red Hat and used as the upstream for Red Hat Directory Server and FreeIPA. LDAP messages carry an optional sequence of controls (RFC 4511 §4.1.11) parsed via BER decoding; the affected get_ldapmessage_controls_ext() routine iterates and allocates per-control structures without bounding the iteration count. This is a classic CWE-770 (Allocation of Resources Without Limits or Throttling) condition: the default 2 MB nsslapd-maxbersize cap on inbound messages permits roughly 10^5-10^6 trivially encoded controls per request, each forcing heap allocation and CPU work in the parser before any access control evaluation occurs.

RemediationAI

No vendor-released patch identified at time of analysis from the provided references; monitor https://access.redhat.com/security/cve/CVE-2026-9064 and https://bugzilla.redhat.com/show_bug.cgi?id=2480093 for the fixed 389-ds-base package version and apply the corresponding RHSA once released. As a compensating control, reduce the inbound message ceiling by lowering nsslapd-maxbersize from its 2 MB default (e.g., to 209715 / 200 KB) to shrink the attainable control count per request - note this will break legitimate clients that send large modifications or bulk attribute writes, so test against your replication and provisioning workflows first. Restrict TCP/389 and TCP/636 at the network layer to known client subnets and place the directory behind a load balancer or LDAP proxy that can enforce per-source request rate limits, accepting the trade-off that proxies add a hop and may interfere with StartTLS or SASL-bound clients. As a last resort during active abuse, raise nsslapd-threadnumber and nsslapd-maxdescriptors to delay thread starvation, understanding this only buys time and increases memory pressure.

CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2021-40438 CRITICAL POC
9.0 Sep 16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4

CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

CVE-2017-1000253 HIGH POC
7.8 Oct 05

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb7

CVE-2017-5645 CRITICAL POC
9.8 Apr 17

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events

CVE-2015-0240 CRITICAL POC
10.0 Feb 24

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1

CVE-2016-6662 CRITICAL POC
9.8 Sep 20

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2

CVE-2025-32463 CRITICAL POC
9.3 Jun 30

Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot opti

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Enterprise Server 16.1 Fixed

Share

CVE-2026-9064 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy