Skip to content
Fencer Vulns
high 7.5

CVE-2026-9064 json

389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)

published 2026-05-20 5 mo ago modified 2026-11-05 4 d ago also EUVD-2026-31079

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits
0
none known

Summary

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.

Patch / fix

  • Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 8060020260609102432.0ca98e7e
  • Red Hat Red Hat Directory Server 11.7 E4S for RHEL 8 8080020260610130252.f969626e
  • Red Hat Red Hat Directory Server 11.9 for RHEL 8 8100020260601104139.37ed7c03
  • Red Hat Red Hat Directory Server 12.2 E4S for RHEL 9 9020020260615123354.1674d574
  • Red Hat Red Hat Directory Server 12.4 E4S for RHEL 9 9040020260611130021.1674d574
  • Red Hat Red Hat Enterprise Linux 10 0:3.2.0-7.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.0.6-18.el10_0
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:1.3.11.1-12.el7_9
  • Red Hat Red Hat Enterprise Linux 8 8100020260601102239.25e700aa
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020260609102422.96015a92
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 8040020260609102422.96015a92
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020260609102416.824efc52
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 8060020260609102416.824efc52
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020260610125847.6dbb3803
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020260610125847.6dbb3803
  • Red Hat Red Hat Enterprise Linux 9 0:2.8.0-7.el9_8
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:2.2.4-18.el9_2
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:2.4.5-25.el9_4
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:2.6.1-21.el9_6
  • Red Hat Red Hat Directory Server 13.2 1781714123
  • 389-ds-base directory server 11.9 1.4.3.39-24.module+el8dsrv+24341+2b6b9665
  • cockpit-389-ds directory server 11.9 1.4.3.39-24.module+el8dsrv+24341+2b6b9665
  • python3-lib389 directory server 11.9 1.4.3.39-24.module+el8dsrv+24341+2b6b9665
  • 389-ds-base-libs directory server 11.9 1.4.3.39-24.module+el8dsrv+24341+2b6b9665
  • 389-ds-base-snmp directory server 11.9 1.4.3.39-24.module+el8dsrv+24341+2b6b9665
  • 389-ds-base-legacy-tools directory server 11.9 1.4.3.39-24.module+el8dsrv+24341+2b6b9665
  • 389-ds-base RHEL 8 1.4.3.39-24.module+el8.10.0+24340+7270ac72
  • python3-lib389 RHEL 8 1.4.3.39-24.module+el8.10.0+24340+7270ac72

red hat advisories RHSA-2026:26639RHSA-2026:26599RHSA-2026:26597RHSA-2026:26464RHSA-2026:26465RHSA-2026:26463

  • 389-ds SLE Module for Server Applications 15 SP7 2.7.0~git193.9ab79d496-150700.3.16.1
  • 389-ds SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 2.2.10~git229.1fa7ffdb4-150500.3.45.1
  • 389-ds SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 2.0.20~git90.9f70d434e-150400.3.51.1
  • 389-ds SLES for SAP 15 SP6, SLES 15 SP6-LTSS 2.2.10~git229.1fa7ffdb4-150600.8.29.1

suse advisories SUSE-SU-2026:2419-1SUSE-SU-2026:2418-1SUSE-SU-2026:2417-1SUSE-SU-2026:2316-1

  • 389-ds openSUSE Tumbleweed 3.1.4+e9d94d45a-1.1

opensuse advisories openSUSE-SU-2026:10870-1

  • 389-ds-base AlmaLinux 9 2.8.0-7.el9_8
  • python3-lib389 AlmaLinux 9 2.8.0-7.el9_8
  • 389-ds-base-libs AlmaLinux 9 2.8.0-7.el9_8
  • 389-ds-base-snmp AlmaLinux 9 2.8.0-7.el9_8
  • 389-ds-base AlmaLinux 8 1.4.3.39-24.module_el8.10.0+4196+be88fbc7
  • python3-lib389 AlmaLinux 8 1.4.3.39-24.module_el8.10.0+4196+be88fbc7
  • 389-ds-base-libs AlmaLinux 8 1.4.3.39-24.module_el8.10.0+4196+be88fbc7
  • 389-ds-base-snmp AlmaLinux 8 1.4.3.39-24.module_el8.10.0+4196+be88fbc7

almalinux advisories ALSA-2026:26455ALSA-2026:26459

  • 389-ds-base Rocky Linux 10 3.2.0-7.el10_2
  • 389-ds-base Rocky Linux 8 1.4.3.39-24.module+el8.10.0+40214+a8ec6bf9
  • 389-ds-base Rocky Linux 9 2.8.0-7.el9_8

rocky linux advisories RLSA-2026:26456RLSA-2026:26459RLSA-2026:26455

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-9064 updated cvss 7.5

389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS)

  • Red Hat Directory Server 12 389-ds-base
    affected: workaround, no fix available
  • Red Hat Directory Server 13 389-ds-base
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 6 389-ds-base, 389-ds-base-libs
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat CodeReady Linux Builder EUS (v.9.6) 389-ds-base-devel 2.6.1-21.el9_6, 389-ds-base-debuginfo 2.6.1-21.el9_6, 389-ds-base-debugsource 2.6.1-21.el9_6, 389-ds-base-libs-debuginfo 2.6.1-21.el9_6, 389-ds-base-snmp-debuginfo 2.6.1-21.el9_6
    fixed: vendor fix RHSA-2026:26465
  • Red Hat Directory Server 11.5 E4S for RHEL 8 389-ds-base 1.4.3.34-6.module+el8dsrv+24373+7e48d0d8, cockpit-389-ds 1.4.3.34-6.module+el8dsrv+24373+7e48d0d8, python3-lib389 1.4.3.34-6.module+el8dsrv+24373+7e48d0d8, 389-ds-base-libs 1.4.3.34-6.module+el8dsrv+24373+7e48d0d8, 389-ds-base-snmp 1.4.3.34-6.module+el8dsrv+24373+7e48d0d8, 389-ds-base-legacy-tools 1.4.3.34-6.module+el8dsrv+24373+7e48d0d8
    fixed: vendor fix RHSA-2026:26461
  • Red Hat Directory Server 11.7 E4S for RHEL 8 389-ds-base 1.4.3.34-15.module+el8dsrv+24378+c77f3fdd, cockpit-389-ds 1.4.3.34-15.module+el8dsrv+24378+c77f3fdd, python3-lib389 1.4.3.34-15.module+el8dsrv+24378+c77f3fdd, 389-ds-base-libs 1.4.3.34-15.module+el8dsrv+24378+c77f3fdd, 389-ds-base-snmp 1.4.3.34-15.module+el8dsrv+24378+c77f3fdd, 389-ds-base-legacy-tools 1.4.3.34-15.module+el8dsrv+24378+c77f3fdd
    fixed: vendor fix RHSA-2026:26597
  • Red Hat Directory Server 11.9 for RHEL 8 389-ds-base 1.4.3.39-24.module+el8dsrv+24341+2b6b9665, cockpit-389-ds 1.4.3.39-24.module+el8dsrv+24341+2b6b9665, python3-lib389 1.4.3.39-24.module+el8dsrv+24341+2b6b9665, 389-ds-base-libs 1.4.3.39-24.module+el8dsrv+24341+2b6b9665, 389-ds-base-snmp 1.4.3.39-24.module+el8dsrv+24341+2b6b9665, 389-ds-base-legacy-tools 1.4.3.39-24.module+el8dsrv+24341+2b6b9665
    fixed: vendor fix RHSA-2026:26458
  • Red Hat Directory Server 12.2 E4S for RHEL 9 389-ds-base 2.2.7-15.module+el9dsrv+24397+ec2d72b6, cockpit-389-ds 2.2.7-15.module+el9dsrv+24397+ec2d72b6, python3-lib389 2.2.7-15.module+el9dsrv+24397+ec2d72b6, 389-ds-base-libs 2.2.7-15.module+el9dsrv+24397+ec2d72b6, 389-ds-base-snmp 2.2.7-15.module+el9dsrv+24397+ec2d72b6
    fixed: vendor fix RHSA-2026:26639
show 19 more
  • Red Hat Directory Server 12.4 E4S for RHEL 9 389-ds-base 2.4.5-23.module+el9dsrv+24381+1cd2f394, cockpit-389-ds 2.4.5-23.module+el9dsrv+24381+1cd2f394, python3-lib389 2.4.5-23.module+el9dsrv+24381+1cd2f394, 389-ds-base-libs 2.4.5-23.module+el9dsrv+24381+1cd2f394, 389-ds-base-snmp 2.4.5-23.module+el9dsrv+24381+1cd2f394
    fixed: vendor fix RHSA-2026:26599
  • Red Hat Directory Server 13.2 dirsrv/dirsrv-container-rhel10 1781714123
    fixed: vendor fix RHSA-2026:27125
  • Red Hat Enterprise Linux AppStream (v. 8) 389-ds-base 1.4.3.39-24.module+el8.10.0+24340+7270ac72, python3-lib389 1.4.3.39-24.module+el8.10.0+24340+7270ac72, 389-ds-base-libs 1.4.3.39-24.module+el8.10.0+24340+7270ac72, 389-ds-base-snmp 1.4.3.39-24.module+el8.10.0+24340+7270ac72, 389-ds-base-legacy-tools 1.4.3.39-24.module+el8.10.0+24340+7270ac72
    fixed: vendor fix RHSA-2026:26459
  • Red Hat Enterprise Linux AppStream (v. 9) 389-ds-base 2.8.0-7.el9_8, python3-lib389 2.8.0-7.el9_8, 389-ds-base-libs 2.8.0-7.el9_8, 389-ds-base-snmp 2.8.0-7.el9_8
    fixed: vendor fix RHSA-2026:26455
  • Red Hat Enterprise Linux AppStream (v. 10) 389-ds-base 3.2.0-7.el10_2, python3-lib389 3.2.0-7.el10_2, 389-ds-base-libs 3.2.0-7.el10_2, 389-ds-base-snmp 3.2.0-7.el10_2
    fixed: vendor fix RHSA-2026:26456
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) 389-ds-base 1.4.3.34-4.module+el8.4.0+24372+0c6355a1, python3-lib389 1.4.3.34-4.module+el8.4.0+24372+0c6355a1, 389-ds-base-libs 1.4.3.34-4.module+el8.4.0+24372+0c6355a1, 389-ds-base-snmp 1.4.3.34-4.module+el8.4.0+24372+0c6355a1, 389-ds-base-legacy-tools 1.4.3.34-4.module+el8.4.0+24372+0c6355a1
    fixed: vendor fix RHSA-2026:26463
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) 389-ds-base 1.4.3.34-9.module+el8.6.0+24371+47116d61, python3-lib389 1.4.3.34-9.module+el8.6.0+24371+47116d61, 389-ds-base-libs 1.4.3.34-9.module+el8.6.0+24371+47116d61, 389-ds-base-snmp 1.4.3.34-9.module+el8.6.0+24371+47116d61, 389-ds-base-legacy-tools 1.4.3.34-9.module+el8.6.0+24371+47116d61
    fixed: vendor fix RHSA-2026:26460
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) 389-ds-base 1.4.3.35-18.module+el8.8.0+24377+19c5500b, python3-lib389 1.4.3.35-18.module+el8.8.0+24377+19c5500b, 389-ds-base-libs 1.4.3.35-18.module+el8.8.0+24377+19c5500b, 389-ds-base-snmp 1.4.3.35-18.module+el8.8.0+24377+19c5500b, 389-ds-base-legacy-tools 1.4.3.35-18.module+el8.8.0+24377+19c5500b
    fixed: vendor fix RHSA-2026:26454
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) 389-ds-base 2.2.4-18.el9_2, python3-lib389 2.2.4-18.el9_2, 389-ds-base-libs 2.2.4-18.el9_2
    fixed: vendor fix RHSA-2026:26452
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) 389-ds-base 2.4.5-25.el9_4, python3-lib389 2.4.5-25.el9_4, 389-ds-base-libs 2.4.5-25.el9_4
    fixed: vendor fix RHSA-2026:26464
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) 389-ds-base 3.0.6-18.el10_0, python3-lib389 3.0.6-18.el10_0, 389-ds-base-libs 3.0.6-18.el10_0, 389-ds-base-snmp 3.0.6-18.el10_0
    fixed: vendor fix RHSA-2026:26457
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) 389-ds-base 2.6.1-21.el9_6, python3-lib389 2.6.1-21.el9_6, 389-ds-base-libs 2.6.1-21.el9_6, 389-ds-base-snmp 2.6.1-21.el9_6
    fixed: vendor fix RHSA-2026:26465
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) 389-ds-base 1.4.3.34-4.module+el8.4.0+24372+0c6355a1, python3-lib389 1.4.3.34-4.module+el8.4.0+24372+0c6355a1, 389-ds-base-libs 1.4.3.34-4.module+el8.4.0+24372+0c6355a1, 389-ds-base-snmp 1.4.3.34-4.module+el8.4.0+24372+0c6355a1, 389-ds-base-legacy-tools 1.4.3.34-4.module+el8.4.0+24372+0c6355a1
    fixed: vendor fix RHSA-2026:26463
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) 389-ds-base 1.4.3.34-9.module+el8.6.0+24371+47116d61, python3-lib389 1.4.3.34-9.module+el8.6.0+24371+47116d61, 389-ds-base-libs 1.4.3.34-9.module+el8.6.0+24371+47116d61, 389-ds-base-snmp 1.4.3.34-9.module+el8.6.0+24371+47116d61, 389-ds-base-legacy-tools 1.4.3.34-9.module+el8.6.0+24371+47116d61
    fixed: vendor fix RHSA-2026:26460
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) 389-ds-base 1.4.3.35-18.module+el8.8.0+24377+19c5500b, python3-lib389 1.4.3.35-18.module+el8.8.0+24377+19c5500b, 389-ds-base-libs 1.4.3.35-18.module+el8.8.0+24377+19c5500b, 389-ds-base-snmp 1.4.3.35-18.module+el8.8.0+24377+19c5500b, 389-ds-base-legacy-tools 1.4.3.35-18.module+el8.8.0+24377+19c5500b
    fixed: vendor fix RHSA-2026:26454
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) 389-ds-base-devel 2.8.0-7.el9_8, 389-ds-base-debuginfo 2.8.0-7.el9_8, 389-ds-base-debugsource 2.8.0-7.el9_8, 389-ds-base-libs-debuginfo 2.8.0-7.el9_8, 389-ds-base-snmp-debuginfo 2.8.0-7.el9_8
    fixed: vendor fix RHSA-2026:26455
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) 389-ds-base-bdb 3.2.0-7.el10_2
    fixed: vendor fix RHSA-2026:26456
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) 389-ds-base-bdb 3.0.6-18.el10_0
    fixed: vendor fix RHSA-2026:26457
  • Red Hat Enterprise Linux Server (v. 7 ELS) 389-ds-base 1.3.11.1-12.el7_9, 389-ds-base-libs 1.3.11.1-12.el7_9 Red Hat Enterprise Linux Server Optional (v. 7 ELS) 389-ds-base 1.3.11.1-12.el7_9, 389-ds-base-libs 1.3.11.1-12.el7_9, 389-ds-base-snmp 1.3.11.1-12.el7_9
    fixed: vendor fix RHSA-2026:26453

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8
  • Red Hat Red Hat Directory Server 11.7 E4S for RHEL 8
  • Red Hat Red Hat Directory Server 11.9 for RHEL 8
  • Red Hat Red Hat Directory Server 12.2 E4S for RHEL 9
  • Red Hat Red Hat Directory Server 12.4 E4S for RHEL 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Directory Server 13.2
  • Red Hat Red Hat Directory Server 12
  • Red Hat Red Hat Directory Server 13
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.