CVE-2026-9064

Summary

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Directory Server 11.5 E4S for RHEL 88060020260609102432.0ca98e7e < *unaffected
Red HatRed Hat Directory Server 11.7 E4S for RHEL 88080020260610130252.f969626e < *unaffected
Red HatRed Hat Directory Server 11.9 for RHEL 88100020260601104139.37ed7c03 < *unaffected
Red HatRed Hat Directory Server 12.2 E4S for RHEL 99020020260615123354.1674d574 < *unaffected
Red HatRed Hat Directory Server 12.4 E4S for RHEL 99040020260611130021.1674d574 < *unaffected
Red HatRed Hat Enterprise Linux 100:3.2.0-7.el10_2 < *unaffected
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support0:3.0.6-18.el10_0 < *unaffected
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support0:1.3.11.1-12.el7_9 < *unaffected
Red HatRed Hat Enterprise Linux 88100020260601102239.25e700aa < *unaffected
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support8040020260609102422.96015a92 < *unaffected
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On8040020260609102422.96015a92 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support8060020260609102416.824efc52 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On8060020260609102416.824efc52 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service8080020260610125847.6dbb3803 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions8080020260610125847.6dbb3803 < *unaffected
Red HatRed Hat Enterprise Linux 90:2.8.0-7.el9_8 < *unaffected
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions0:2.2.4-18.el9_2 < *unaffected
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions0:2.4.5-25.el9_4 < *unaffected
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support0:2.6.1-21.el9_6 < *unaffected
Red HatRed Hat Directory Server 13.21781714123 < *unaffected

Weaknesses

  • CWE-770: Allocation of Resources Without Limits or Throttling

Workarounds

Restrict network access to the LDAP port (389/tcp, 636/tcp) to trusted networks only using firewall rules or network ACLs. This prevents untrusted remote attackers from reaching the vulnerable code path.

Optionally, lower the nsslapd-maxbersize configuration parameter to reduce the maximum BER message size accepted by the server. Note that this caps bytes, not the number of controls, and does not fully eliminate the amplification. Setting it too low may impact legitimate LDAP operations with large payloads.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS)

Additional References

References