CVE-2026-18663Medium· 5.9▾ SunlitA flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPI_REQCONTROLS pblock slot. Operation teardown t…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.5%
A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPI_REQCONTROLS pblock slot. Operation teardown then frees the same pointer again, causing a double-free. An unauthenticated remote attacker can trigger this with a single BIND request carrying a critical Session Tracking control, resulting in heap corruption and potential denial of service.
redhat-ds:11/389-ds-baseredhat-ds:12/389-ds-base389-ds-base (all versions)389-ds-base (all versions)389-ds-base389-ds-base389-ds:1.4/389-ds-base389-ds-baseRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
On builds that include upstream Issue 7389 (committed 2026-04-09, present in 389-ds-base-3.2 branch), administrators can add the Session Tracking control OID (1.3.6.1.4.1.21008.108.63.1) to the ds-ignored-control-criticality configuration attribute. This causes the server to ignore the criticality flag on this control, preventing the vulnerable rejection path from being reached.
Additionally, network-level restriction of access to the LDAP port (389/636) to trusted clients reduces exposure.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-16560Medium· 5.3389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued rdn
CVE-2026-14969Medium· 4.4389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption
CVE-2026-14940Medium· 5.3389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn
CVE-2026-11884Medium· 6.5389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation
CVE-2026-11789Medium· 4.9389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash
CVE-2026-11790Medium· 4.9389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service