Description
A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.
Published: 2026-09-07
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A missing NULL pointer check in the paged results handling of op_shared_search in 389 Directory Server allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests that use the USE_ONE_BACKEND control. This results in a denial of service because the server terminates unexpectedly.

Affected Systems

Red Hat Directory Server versions 11 through 13, and Red Hat Enterprise Linux releases 6, 7, 8, 9, and 10 are affected. The vulnerability resides in the LDAP server package distributed with these operating systems and numbered accordingly.

Risk and Exploitability

The CVSS score of 7.5 indicates a moderate to high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is an unauthenticated remote attacker who can send crafted LDAP search requests over the network. No elevated privileges or local access are required. The exploit leads to a crash of the LDAP service, causing denial of service for clients relying on directory services.

Generated by OpenCVE AI on September 7, 2026 at 15:39 UTC.

Remediation

Vendor Workaround

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

OpenCVE Recommended Actions

  • Apply the officially advised Red Hat workaround: no practical mitigation is available; proceed with immediate package update as soon as possible.
  • Update the affected LDAP server package to the latest Red Hat release that includes the null‑pointer check fix.
  • If an immediate package update is not available, limit access to the LDAP service to trusted hosts only to reduce exposure to crafted requests.
  • Continuously monitor LDAP logs and system stability for signs of crashes or abnormal connections while awaiting the patch update.

Generated by OpenCVE AI on September 7, 2026 at 15:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat directory Server E4s
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Eus Long Life
Redhat rhel Tus
CPEs cpe:/a:redhat:directory_server_e4s:11.7::el8
cpe:/a:redhat:directory_server_e4s:12.2::el9
cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/a:redhat:rhel_e4s:9.4::appstream
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
Vendors & Products Redhat directory Server E4s
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Eus Long Life
Redhat rhel Tus
References

Tue, 08 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
References

Tue, 08 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 07 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.
Title 389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search
First Time appeared Redhat
Redhat directory Server
Redhat enterprise Linux
Weaknesses CWE-476
CPEs cpe:/a:redhat:directory_server:11
cpe:/a:redhat:directory_server:12
cpe:/a:redhat:directory_server:13
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat directory Server
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Redhat Directory Server Directory Server E4s Enterprise Linux Rhel Aus Rhel E4s Rhel Els Rhel Eus Long Life Rhel Tus
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-08T03:08:42.999Z

Reserved: 2026-07-31T06:49:45.234Z

Link: CVE-2026-18453

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-07T15:17:31.017

Modified: 2026-09-08T03:17:18.287

Link: CVE-2026-18453

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-07T09:00:00Z

Links: CVE-2026-18453 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T15:45:17Z

Weaknesses