Description
A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.
Published: 2026-09-07
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

A missing NULL pointer check in the paged results handling of op_shared_search in 389 Directory Server allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests that use the USE_ONE_BACKEND control. This results in a denial of service because the server terminates unexpectedly.

Affected Systems

Red Hat Directory Server versions 11 through 13, and Red Hat Enterprise Linux releases 6, 7, 8, 9, and 10 are affected. The vulnerability resides in the LDAP server package distributed with these operating systems and numbered accordingly.

Risk and Exploitability

The CVSS score of 7.5 indicates a moderate to high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is an unauthenticated remote attacker who can send crafted LDAP search requests over the network. No elevated privileges or local access are required. The exploit leads to a crash of the LDAP service, causing denial of service for clients relying on directory services.

Generated by OpenCVE AI on September 7, 2026 at 15:39 UTC.

Remediation

Vendor Workaround

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

OpenCVE Recommended Actions

  • Apply the officially advised Red Hat workaround: no practical mitigation is available; proceed with immediate package update as soon as possible.
  • Update the affected LDAP server package to the latest Red Hat release that includes the null‑pointer check fix.
  • If an immediate package update is not available, limit access to the LDAP service to trusted hosts only to reduce exposure to crafted requests.
  • Continuously monitor LDAP logs and system stability for signs of crashes or abnormal connections while awaiting the patch update.

Generated by OpenCVE AI on September 7, 2026 at 15:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:directory_server:13.2::el10
References

Tue, 08 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat redhat Directory Server
Vendors & Products Redhat redhat Directory Server

Tue, 08 Sep 2026 08:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:directory_server:11
cpe:/o:redhat:enterprise_linux:10		 cpe:/a:redhat:directory_server:11.9::el8
cpe:/a:redhat:directory_server_e4s:12.4::el9
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_eus_long_life:8.6::appstream
cpe:/o:redhat:enterprise_linux:10.2
References

Tue, 08 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
References

Tue, 08 Sep 2026 05:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:8::appstream
References

Tue, 08 Sep 2026 04:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:9.6::appstream
cpe:/a:redhat:rhel_eus:9.6::crb
cpe:/o:redhat:enterprise_linux_eus:10.0
Vendors & Products Redhat enterprise Linux Eus
Redhat rhel Eus
References

Tue, 08 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat directory Server E4s
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Eus Long Life
Redhat rhel Tus
CPEs cpe:/a:redhat:directory_server_e4s:11.7::el8
cpe:/a:redhat:directory_server_e4s:12.2::el9
cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/a:redhat:rhel_e4s:9.4::appstream
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
Vendors & Products Redhat directory Server E4s
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Eus Long Life
Redhat rhel Tus
References

Tue, 08 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
References

Tue, 08 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 07 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.
Title 389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search
First Time appeared Redhat
Redhat directory Server
Redhat enterprise Linux
Weaknesses CWE-476
CPEs cpe:/a:redhat:directory_server:11
cpe:/a:redhat:directory_server:12
cpe:/a:redhat:directory_server:13
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat directory Server
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Redhat Directory Server Directory Server E4s Enterprise Linux Enterprise Linux Eus Redhat Directory Server Rhel Aus Rhel E4s Rhel Els Rhel Eus Rhel Eus Long Life Rhel Tus
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-09T14:40:15.528Z

Reserved: 2026-07-31T06:49:45.234Z

Link: CVE-2026-18453

cve-icon Vulnrichment

Updated: 2026-09-09T14:40:08.803Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-07T15:17:31.017

Modified: 2026-09-09T15:17:06.310

Link: CVE-2026-18453

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-07T09:00:00Z

Links: CVE-2026-18453 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-08T20:36:56Z

Weaknesses