Bug 2514499

Summary: CVE-2026-18663 389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical Session Tracking control [fedora-all]
Product: [Fedora] Fedora Reporter: Samuele Negrini <snegrini>
Component: 389-ds-baseAssignee: mreynolds
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: abokovoy, jachapma, mreynolds, spichugi, tbordaz, vashirov
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---Flags: fedora-admin-xmlrpc: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["b66cfcc4-ba42-4385-8ca6-a6d2c60d5584"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2510631    

Description Samuele Negrini 2026-08-12 07:24:21 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in 389-ds-base. When parsing LDAP request controls, the get_ldapmessage_controls_ext() function publishes the decoded controls array into the operation's pblock (SLAPI_REQCONTROLS) and then, if a Session Tracking control (OID 1.3.6.1.4.1.21008.108.63.1) is present and marked critical, rejects the request through an error path that frees the controls array via ldap_controls_free() without clearing the pblock slot. Operation teardown in operation_done() subsequently frees the same pointer again through o_params.request_controls, producing a double-free.

Since controls are parsed before authentication (a BIND request suffices) and the Session Tracking control is registered for BIND at server startup, an unauthenticated remote attacker can trigger the double-free with a single malformed BIND request.

On RHEL product builds, ns-slapd is linked against jemalloc which silently absorbs the double-free without crashing. However, the underlying heap corruption constitutes undefined behavior and on builds without jemalloc (upstream default, Fedora, ASan builds) the double-free reliably crashes the server, causing a denial of service.

The vulnerable code was introduced in commit fd627001b (Issue 6367, 2024-11-29) which added Session Tracking control support. Only 389-ds-base 3.x versions are affected (RHEL 10, RHDS 13, Fedora). Versions 2.x and 1.4.x (RHEL 9, RHEL 8, RHDS 11, RHDS 12) do not contain the Session Tracking feature and are not affected.