A flaw was found in 389-ds-base. When parsing LDAP request controls, the get_ldapmessage_controls_ext() function publishes the decoded controls array into the operation's pblock (SLAPI_REQCONTROLS) and then, if a Session Tracking control (OID 1.3.6.1.4.1.21008.108.63.1) is present and marked critical, rejects the request through an error path that frees the controls array via ldap_controls_free() without clearing the pblock slot. Operation teardown in operation_done() subsequently frees the same pointer again through o_params.request_controls, producing a double-free.

Since controls are parsed before authentication (a BIND request suffices) and the Session Tracking control is registered for BIND at server startup, an unauthenticated remote attacker can trigger the double-free with a single malformed BIND request.

On RHEL product builds, ns-slapd is linked against jemalloc which silently absorbs the double-free without crashing. However, the underlying heap corruption constitutes undefined behavior and on builds without jemalloc (upstream default, Fedora, ASan builds) the double-free reliably crashes the server, causing a denial of service.

The vulnerable code was introduced in commit fd627001b (Issue 6367, 2024-11-29) which added Session Tracking control support. Only 389-ds-base 3.x versions are affected (RHEL 10, RHDS 13, Fedora). Versions 2.x and 1.4.x (RHEL 9, RHEL 8, RHDS 11, RHDS 12) do not contain the Session Tracking feature and are not affected.