CVE-2026-9064 Details

A denial-of-service vulnerability has been identified in 389 Directory Server versions 11, 12, 13, and in Red Hat Enterprise Linux 10, 7, 8, and 9. The issue arises in the LDAP server's 'get_ldapmessage_controls_ext()' function, which fails to limit the number of controls per LDAP message. This flaw allows a remote, unauthenticated attacker to send a crafted LDAP request with hundreds of thousands of minimal controls, within the default maximum BER message size of 2 MB. The exploitation causes excessive CPU usage and memory allocation on the server. When exploited concurrently, it leads to significant latency, worker thread starvation, or out-of-memory conditions, causing a denial-of-service.

Restrict network access to the LDAP port to trusted networks only, using firewall rules or network ACLs. This prevents untrusted remote attackers from reaching the vulnerable code. Optionally, lower the 'nsslapd-maxbersize' configuration parameter to reduce the maximum BER message size accepted by the server, but be cautious as setting it too low may impact legitimate LDAP operations that require larger payloads.