Read the docs
TI-2026-07965 Aliases CVE-2026-9064GHSA-7r3c-wfgh-x96c

Resource allocation without limits in 389-ds-base

Priority MEDIUM 40CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 25 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00815 57th percentileScored 2026-11-07
Fix Partial Red Hat: 17 advisoriesRed Hat: 25 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—389-ds-baseall versions—No fix listedCNA
Red HatRed Hat Directory Server 11.5 E4S for RHEL 8—8060020260609102432.0ca98e7ePatch availableCNA
Red HatRed Hat Directory Server 11.7 E4S for RHEL 8—8080020260610130252.f969626ePatch availableCNA
Red HatRed Hat Directory Server 11.9 for RHEL 8—8100020260601104139.37ed7c03Patch availableCNA
Red HatRed Hat Directory Server 12.2 E4S for RHEL 9—9020020260615123354.1674d574Patch availableCNA
Red HatRed Hat Directory Server 12.4 E4S for RHEL 9—9040020260611130021.1674d574Patch availableCNA
Red HatRed Hat Enterprise Linux 10—3.2.0-7.el10_2Patch availableCNA
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—3.0.6-18.el10_0Patch availableCNA
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—1.3.11.1-12.el7_9Patch availableCNA
Red HatRed Hat Enterprise Linux 8—8100020260601102239.25e700aaPatch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—8040020260609102422.96015a92Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—8040020260609102422.96015a92Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—8060020260609102416.824efc52Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On—8060020260609102416.824efc52Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—8080020260610125847.6dbb3803Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—8080020260610125847.6dbb3803Patch availableCNA
Red HatRed Hat Enterprise Linux 9—2.8.0-7.el9_8Patch availableCNA
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—2.2.4-18.el9_2Patch availableCNA
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—2.4.5-25.el9_4Patch availableCNA
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—2.6.1-21.el9_6Patch availableCNA
Red HatRed Hat Directory Server 13.2—1781714123Patch availableCNA
Red HatRed Hat Directory Server 12——No fix listedCNA
Red HatRed Hat Directory Server 13——No fix listedCNA
Red HatRed Hat Enterprise Linux 6——No fix listedCNA
  • 389-ds-base Vendor— Affected all versions Fixed in — No fix listed CNA
  • Red Hat Directory Server 11.5 E4S for RHEL 8 VendorRed Hat Affected — Fixed in 8060020260609102432.0ca98e7e Patch available CNA
  • Red Hat Directory Server 11.7 E4S for RHEL 8 VendorRed Hat Affected — Fixed in 8080020260610130252.f969626e Patch available CNA
  • Red Hat Directory Server 11.9 for RHEL 8 VendorRed Hat Affected — Fixed in 8100020260601104139.37ed7c03 Patch available CNA
  • Red Hat Directory Server 12.2 E4S for RHEL 9 VendorRed Hat Affected — Fixed in 9020020260615123354.1674d574 Patch available CNA
  • Red Hat Directory Server 12.4 E4S for RHEL 9 VendorRed Hat Affected — Fixed in 9040020260611130021.1674d574 Patch available CNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 3.2.0-7.el10_2 Patch available CNA
  • Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 3.0.6-18.el10_0 Patch available CNA
  • Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 1.3.11.1-12.el7_9 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8100020260601102239.25e700aa Patch available CNA
  • Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8040020260609102422.96015a92 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 8040020260609102422.96015a92 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8060020260609102416.824efc52 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 8060020260609102416.824efc52 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8080020260610125847.6dbb3803 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8080020260610125847.6dbb3803 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.8.0-7.el9_8 Patch available CNA
  • Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.2.4-18.el9_2 Patch available CNA
  • Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.4.5-25.el9_4 Patch available CNA
  • Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 2.6.1-21.el9_6 Patch available CNA
  • Red Hat Directory Server 13.2 VendorRed Hat Affected — Fixed in 1781714123 Patch available CNA
  • Red Hat Directory Server 12 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Directory Server 13 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:redhat:directory_server:11.0:*:*:*:*:*:*:*11.0VulnerableRed Hat
cpe:2.3:a:redhat:directory_server:12.0:*:*:*:*:*:*:*12.0VulnerableRed Hat
cpe:2.3:a:redhat:directory_server:13.0:*:*:*:*:*:*:*13.0VulnerableRed Hat
cpe:2.3:o:redhat:389_directory_server:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*10.0VulnerableRed Hat
  • cpe:2.3:a:redhat:directory_server:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:directory_server:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:directory_server:13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:389_directory_server:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat

Remediation

Red Hat 17 advisories

  • RHSA-2026:27125 Released 2026-06-18 · Red Hat rating Important
    Red Hat Directory Server 13.2 container image update
    • Red Hat Directory Server 13.2 registry.redhat.io/dirsrv/dirsrv-container-rhel10
  • RHSA-2026:26639 Released 2026-06-17 · Red Hat rating Important
    redhat-ds:12 security update
    • Red Hat Directory Server 12.2 E4S for RHEL 9 389-ds-base-2.2.7-15.module+el9dsrv+24397+ec2d72b6.src::redhat-ds:12, 389-ds-base-2.2.7-15.module+el9dsrv+24397+ec2d72b6.x86_64::redhat-ds:12, 389-ds-base-devel-2.2.7-15.module+el9dsrv+24397+ec2d72b6.x86_64::redhat-ds:12 +4
  • RHSA-2026:26599 Released 2026-06-17 · Red Hat rating Important
    redhat-ds:12 security update
    • Red Hat Directory Server 12.4 E4S for RHEL 9 389-ds-base-2.4.5-23.module+el9dsrv+24381+1cd2f394.src::redhat-ds:12, 389-ds-base-2.4.5-23.module+el9dsrv+24381+1cd2f394.x86_64::redhat-ds:12, 389-ds-base-devel-2.4.5-23.module+el9dsrv+24381+1cd2f394.x86_64::redhat-ds:12 +4
Show 14 more Red Hat advisories
  • RHSA-2026:26597 Released 2026-06-17 · Red Hat rating Important
    redhat-ds:11 security update
    • Red Hat Directory Server 11.7 E4S for RHEL 8 389-ds-base-1.4.3.34-15.module+el8dsrv+24378+c77f3fdd.src::redhat-ds:11, 389-ds-base-1.4.3.34-15.module+el8dsrv+24378+c77f3fdd.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.3.34-15.module+el8dsrv+24378+c77f3fdd.x86_64::redhat-ds:11 +5
  • RHSA-2026:26465 Released 2026-06-17 · Red Hat rating Important
    389-ds-base security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) 389-ds-base-devel-2.6.1-21.el9_6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) 389-ds-base-2.6.1-21.el9_6, 389-ds-base-libs-2.6.1-21.el9_6, 389-ds-base-snmp-2.6.1-21.el9_6 +1
  • RHSA-2026:26456 Released 2026-06-17 · Red Hat rating Important
    389-ds-base security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) 389-ds-base-3.2.0-7.el10_2, 389-ds-base-libs-3.2.0-7.el10_2, 389-ds-base-snmp-3.2.0-7.el10_2 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) 389-ds-base-bdb-3.2.0-7.el10_2, 389-ds-base-devel-3.2.0-7.el10_2
  • RHSA-2026:26459 Released 2026-06-17 · Red Hat rating Important
    389-ds:1.4 security update
    • Red Hat Enterprise Linux AppStream (v. 8) 389-ds-base-1.4.3.39-24.module+el8.10.0+24340+7270ac72.aarch64::389-ds:1.4, 389-ds-base-1.4.3.39-24.module+el8.10.0+24340+7270ac72.ppc64le::389-ds:1.4, 389-ds-base-1.4.3.39-24.module+el8.10.0+24340+7270ac72.s390x::389-ds:1.4 +19
  • RHSA-2026:26455 Released 2026-06-17 · Red Hat rating Important
    389-ds-base security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) 389-ds-base-2.8.0-7.el9_8, 389-ds-base-libs-2.8.0-7.el9_8, 389-ds-base-snmp-2.8.0-7.el9_8 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) 389-ds-base-devel-2.8.0-7.el9_8
  • RHSA-2026:26464 Released 2026-06-17 · Red Hat rating Important
    389-ds-base security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) 389-ds-base-2.4.5-25.el9_4, 389-ds-base-libs-2.4.5-25.el9_4, python3-lib389-2.4.5-25.el9_4
  • RHSA-2026:26463 Released 2026-06-17 · Red Hat rating Important
    389-ds:1.4 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) 389-ds-base-1.4.3.34-4.module+el8.4.0+24372+0c6355a1.src::389-ds:1.4, 389-ds-base-1.4.3.34-4.module+el8.4.0+24372+0c6355a1.x86_64::389-ds:1.4, 389-ds-base-devel-1.4.3.34-4.module+el8.4.0+24372+0c6355a1.x86_64::389-ds:1.4 +4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) 389-ds-base-1.4.3.34-4.module+el8.4.0+24372+0c6355a1.src::389-ds:1.4, 389-ds-base-1.4.3.34-4.module+el8.4.0+24372+0c6355a1.x86_64::389-ds:1.4, 389-ds-base-devel-1.4.3.34-4.module+el8.4.0+24372+0c6355a1.x86_64::389-ds:1.4 +4
  • RHSA-2026:26460 Released 2026-06-17 · Red Hat rating Important
    389-ds:1.4 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) 389-ds-base-1.4.3.34-9.module+el8.6.0+24371+47116d61.src::389-ds:1.4, 389-ds-base-1.4.3.34-9.module+el8.6.0+24371+47116d61.x86_64::389-ds:1.4, 389-ds-base-devel-1.4.3.34-9.module+el8.6.0+24371+47116d61.x86_64::389-ds:1.4 +4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) 389-ds-base-1.4.3.34-9.module+el8.6.0+24371+47116d61.src::389-ds:1.4, 389-ds-base-1.4.3.34-9.module+el8.6.0+24371+47116d61.x86_64::389-ds:1.4, 389-ds-base-devel-1.4.3.34-9.module+el8.6.0+24371+47116d61.x86_64::389-ds:1.4 +4
  • RHSA-2026:26457 Released 2026-06-17 · Red Hat rating Important
    389-ds-base security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) 389-ds-base-3.0.6-18.el10_0, 389-ds-base-libs-3.0.6-18.el10_0, 389-ds-base-snmp-3.0.6-18.el10_0 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) 389-ds-base-bdb-3.0.6-18.el10_0, 389-ds-base-devel-3.0.6-18.el10_0
  • RHSA-2026:26461 Released 2026-06-17 · Red Hat rating Important
    redhat-ds:11 security update
    • Red Hat Directory Server 11.5 E4S for RHEL 8 389-ds-base-1.4.3.34-6.module+el8dsrv+24373+7e48d0d8.src::redhat-ds:11, 389-ds-base-1.4.3.34-6.module+el8dsrv+24373+7e48d0d8.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.3.34-6.module+el8dsrv+24373+7e48d0d8.x86_64::redhat-ds:11 +5
  • RHSA-2026:26453 Released 2026-06-17 · Red Hat rating Important
    389-ds-base security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) 389-ds-base-1.3.11.1-12.el7_9, 389-ds-base-libs-1.3.11.1-12.el7_9
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) 389-ds-base-1.3.11.1-12.el7_9, 389-ds-base-devel-1.3.11.1-12.el7_9, 389-ds-base-libs-1.3.11.1-12.el7_9 +1
  • RHSA-2026:26454 Released 2026-06-17 · Red Hat rating Important
    389-ds:1.4 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) 389-ds-base-1.4.3.35-18.module+el8.8.0+24377+19c5500b.ppc64le::389-ds:1.4, 389-ds-base-1.4.3.35-18.module+el8.8.0+24377+19c5500b.src::389-ds:1.4, 389-ds-base-1.4.3.35-18.module+el8.8.0+24377+19c5500b.x86_64::389-ds:1.4 +9
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) 389-ds-base-1.4.3.35-18.module+el8.8.0+24377+19c5500b.src::389-ds:1.4, 389-ds-base-1.4.3.35-18.module+el8.8.0+24377+19c5500b.x86_64::389-ds:1.4, 389-ds-base-devel-1.4.3.35-18.module+el8.8.0+24377+19c5500b.x86_64::389-ds:1.4 +4
  • RHSA-2026:26452 Released 2026-06-17 · Red Hat rating Important
    389-ds-base security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) 389-ds-base-2.2.4-18.el9_2, 389-ds-base-libs-2.2.4-18.el9_2, python3-lib389-2.2.4-18.el9_2
  • RHSA-2026:26458 Released 2026-06-17 · Red Hat rating Important
    redhat-ds:11 security update
    • Red Hat Directory Server 11.9 for RHEL 8 389-ds-base-1.4.3.39-24.module+el8dsrv+24341+2b6b9665.src::redhat-ds:11, 389-ds-base-1.4.3.39-24.module+el8dsrv+24341+2b6b9665.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.3.39-24.module+el8dsrv+24341+2b6b9665.x86_64::redhat-ds:11 +5

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Directory Server 12AffectedNo fix yet
Red Hat Directory Server 13AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:26465
Red Hat Directory Server 11.5 E4S for RHEL 8Fixed RHSA-2026:26461
Red Hat Directory Server 11.7 E4S for RHEL 8Fixed RHSA-2026:26597
Red Hat Directory Server 11.9 for RHEL 8Fixed RHSA-2026:26458
Red Hat Directory Server 12.2 E4S for RHEL 9Fixed RHSA-2026:26639
Red Hat Directory Server 12.4 E4S for RHEL 9Fixed RHSA-2026:26599
Red Hat Directory Server 13.2Fixed RHSA-2026:27125
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:26456
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:26459
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:26455
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:26463
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:26460
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:26454
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:26452
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:26464
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:26457
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:26465
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:26463
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:26460
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:26454
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:26456
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:26455
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:26457
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:26453
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:26453

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9064
  2. 2026-10-03 Alias added: GHSA-7r3c-wfgh-x96c

References

Advisory 19

  • TI-2026-13229 Stack-based buffer overflow in Red Hat Directory Server 11.5 E4S for RHEL 8 CVSS 3.1HIGH 7.5
  • TI-2026-10157 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check CVSS 3.1HIGH 7.5
  • TI-2024-05784 389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request CVSS 3.1MEDIUM 6.5
  • TI-2022-01808 Authorization bypass in 389-ds-base CVSS 3.1HIGH 7.5
  • TI-2010-02131 NULL pointer dereference in Red Hat Directory Server CVSS 3.1HIGH 7.5
  • TI-2026-10175 389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser CVSS 3.1HIGH 7.5
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences