← CVE Intelligence

CVE-2026-9064

389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos) PUBLISHED

Description (CNA)

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.

Affected (CNA)

Vendor / productVersions
Not supplied / Not suppliedaffected 0
Red Hat / Red Hat Directory Server 11.5 E4S for RHEL 8unaffected 8060020260609102432.0ca98e7e before *
Red Hat / Red Hat Directory Server 11.7 E4S for RHEL 8unaffected 8080020260610130252.f969626e before *
Red Hat / Red Hat Directory Server 11.9 for RHEL 8unaffected 8100020260601104139.37ed7c03 before *
Red Hat / Red Hat Directory Server 12.2 E4S for RHEL 9unaffected 9020020260615123354.1674d574 before *
Red Hat / Red Hat Directory Server 12.4 E4S for RHEL 9unaffected 9040020260611130021.1674d574 before *
Red Hat / Red Hat Enterprise Linux 10unaffected 0:3.2.0-7.el10_2 before *
Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Supportunaffected 0:3.0.6-18.el10_0 before *
Red Hat / Red Hat Enterprise Linux 7 Extended Lifecycle Supportunaffected 0:1.3.11.1-12.el7_9 before *
Red Hat / Red Hat Enterprise Linux 8unaffected 8100020260601102239.25e700aa before *
Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 8040020260609102422.96015a92 before *
Red Hat / Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onunaffected 8040020260609102422.96015a92 before *
Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 8060020260609102416.824efc52 before *
Red Hat / Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-Onunaffected 8060020260609102416.824efc52 before *
Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Serviceunaffected 8080020260610125847.6dbb3803 before *
Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionsunaffected 8080020260610125847.6dbb3803 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:2.8.0-7.el9_8 before *
Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionsunaffected 0:2.2.4-18.el9_2 before *
Red Hat / Red Hat Enterprise Linux 9.4 Update Services for SAP Solutionsunaffected 0:2.4.5-25.el9_4 before *
Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Supportunaffected 0:2.6.1-21.el9_6 before *
Red Hat / Red Hat Directory Server 13.2unaffected 1781714123 before *
Red Hat / Red Hat Directory Server 12affected
Red Hat / Red Hat Directory Server 13affected
Red Hat / Red Hat Enterprise Linux 6unknown

CWE

CWE-770

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.