Bug 2480093 (CVE-2026-9064)

Summary: CVE-2026-9064 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS)
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: POST --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aadhikar, bsmejkal, jachapma, mreynolds, progier, rhel-process-autobot, snegrini, spichugi, tbordaz, vashirov, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2480099    
Bug Blocks:    

Description OSIDB Bzimport 2026-05-20 07:36:35 UTC 
A vulnerability was found in 389-ds-base (389 Directory Server). The function get_ldapmessage_controls_ext() in ldap/servers/slapd/control.c parses the optional LDAP v3 Controls field via a decode loop that allocates one LDAPControl struct per control element and grows the pointer list with repeated reallocations, but does not enforce a hard upper bound on the number of controls per message.

Under the default nsslapd-maxbersize of 2097152 (2 MB), a remote unauthenticated client can encode hundreds of thousands of minimal non-critical controls in a single LDAP request, forcing attacker-amplified CPU time and heap allocation. The control parsing occurs pre-authentication (e.g., during Bind request processing at bind.c:227), meaning no credentials are required to trigger the vulnerability.

Concurrency testing shows that with 4 concurrent 400000-controls Bind requests, heavy requests frequently exceed a 10-second client-side timeout, and independent small probes see latency spikes (baseline p50 ~3ms to stress p50 ~45ms). Sustained pressure can cause worker starvation or OOM termination.

This vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), similar in pattern to CVE-2019-10171 in 389-ds-base.

Upstream repository: https://github.com/389ds/389-ds-base
Callsite: ldap/servers/slapd/control.c, function get_ldapmessage_controls_ext(), line 382-383
Bind entry: ldap/servers/slapd/bind.c, line 227
Confirmed at commit: 761452f79c30bbfd0d6756c4a8ed39549fde5717

Reported by: Oleh Konko of 1seal.org (security)
Original report: PSIRTSUPT-6092
Comment 1 mreynolds 2026-05-21 18:44:34 UTC 
Fixed upstream: https://github.com/389ds/389-ds-base/issues/7503
Comment 2 errata-xmlrpc 2026-06-17 00:34:57 UTC 
This issue has been addressed in the following products:

  Red Hat Directory Server 11.9 for RHEL 8

Via RHSA-2026:26458 https://access.redhat.com/errata/RHSA-2026:26458
Comment 3 errata-xmlrpc 2026-06-17 00:36:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:26452 https://access.redhat.com/errata/RHSA-2026:26452
Comment 4 errata-xmlrpc 2026-06-17 00:37:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:26453 https://access.redhat.com/errata/RHSA-2026:26453
Comment 5 errata-xmlrpc 2026-06-17 00:37:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:26454 https://access.redhat.com/errata/RHSA-2026:26454
Comment 6 errata-xmlrpc 2026-06-17 00:47:42 UTC 
This issue has been addressed in the following products:

  Red Hat Directory Server 11.5 E4S for RHEL 8

Via RHSA-2026:26461 https://access.redhat.com/errata/RHSA-2026:26461
Comment 7 errata-xmlrpc 2026-06-17 01:16:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:26457 https://access.redhat.com/errata/RHSA-2026:26457
Comment 8 errata-xmlrpc 2026-06-17 01:26:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:26460 https://access.redhat.com/errata/RHSA-2026:26460
Comment 9 errata-xmlrpc 2026-06-17 01:26:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:26455 https://access.redhat.com/errata/RHSA-2026:26455
Comment 10 errata-xmlrpc 2026-06-17 01:32:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:26464 https://access.redhat.com/errata/RHSA-2026:26464
Comment 11 errata-xmlrpc 2026-06-17 01:34:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:26456 https://access.redhat.com/errata/RHSA-2026:26456
Comment 12 errata-xmlrpc 2026-06-17 01:34:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:26463 https://access.redhat.com/errata/RHSA-2026:26463
Comment 13 errata-xmlrpc 2026-06-17 01:36:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:26459 https://access.redhat.com/errata/RHSA-2026:26459
Comment 14 errata-xmlrpc 2026-06-17 01:45:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:26465 https://access.redhat.com/errata/RHSA-2026:26465
Comment 15 errata-xmlrpc 2026-06-17 14:09:35 UTC 
This issue has been addressed in the following products:

  Red Hat Directory Server 11.7 E4S for RHEL 8

Via RHSA-2026:26597 https://access.redhat.com/errata/RHSA-2026:26597
Comment 16 errata-xmlrpc 2026-06-17 14:17:17 UTC 
This issue has been addressed in the following products:

  Red Hat Directory Server 12.4 E4S for RHEL 9

Via RHSA-2026:26599 https://access.redhat.com/errata/RHSA-2026:26599
Comment 17 errata-xmlrpc 2026-06-17 15:44:19 UTC 
This issue has been addressed in the following products:

  Red Hat Directory Server 12.2 E4S for RHEL 9

Via RHSA-2026:26639 https://access.redhat.com/errata/RHSA-2026:26639