Bug 2510631 (CVE-2026-18663)

Summary:	CVE-2026-18663 389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical Session Tracking control
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aadhikar, bsmejkal, jachapma, mreynolds, progier, rhel-process-autobot, security-response-team, snegrini, spichugi, tbordaz, vashirov, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPI_REQCONTROLS pblock slot. Operation teardown then frees the same pointer again, causing a double-free. An unauthenticated remote attacker can trigger this with a single BIND request carrying a critical Session Tracking control, resulting in heap corruption and potential denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2514499
Bug Blocks:

Description OSIDB Bzimport 2026-08-03 12:49:10 UTC

A flaw was found in 389-ds-base. When parsing LDAP request controls, the get_ldapmessage_controls_ext() function publishes the decoded controls array into the operation's pblock (SLAPI_REQCONTROLS) and then, if a Session Tracking control (OID 1.3.6.1.4.1.21008.108.63.1) is present and marked critical, rejects the request through an error path that frees the controls array via ldap_controls_free() without clearing the pblock slot. Operation teardown in operation_done() subsequently frees the same pointer again through o_params.request_controls, producing a double-free.

Since controls are parsed before authentication (a BIND request suffices) and the Session Tracking control is registered for BIND at server startup, an unauthenticated remote attacker can trigger the double-free with a single malformed BIND request.

On RHEL product builds, ns-slapd is linked against jemalloc which silently absorbs the double-free without crashing. However, the underlying heap corruption constitutes undefined behavior and on builds without jemalloc (upstream default, Fedora, ASan builds) the double-free reliably crashes the server, causing a denial of service.

The vulnerable code was introduced in commit fd627001b (Issue 6367, 2024-11-29) which added Session Tracking control support. Only 389-ds-base 3.x versions are affected (RHEL 10, RHDS 13, Fedora). Versions 2.x and 1.4.x (RHEL 9, RHEL 8, RHDS 11, RHDS 12) do not contain the Session Tracking feature and are not affected.