A flaw in the 389-ds-base server causes a double‑free in the get_ldapmessage_controls_ext() function when handling a critical Session Tracking control during the BIND operation. The vulnerable code frees the parsed controls array but leaves the internal slot referencing it uncleared, so the teardown process later frees the same pointer again. This results in heap corruption that an unauthenticated attacker can exploit by sending a single BIND request containing the critical control, leading to a denial of service on the LDAP server.

The vulnerability affects Red Hat Directory Server releases 11, 12, and 13, as well as Red Hat Enterprise Linux 10, 6, 7, 8, and 9 distributions that include the affected Directory Server packages. No specific patch version is listed, so any installation of these products should be evaluated for the presence of the fix or workaround.

The CVSS score of 5.9 denotes a moderate severity, and the EPSS score is currently unavailable, indicating no publicly known widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog and, as such, there are no confirmed exploits in the wild. Nonetheless, because the flaw can be triggered remotely without authentication and causes service disruption, its impact on availability warrants defensive action. The attack vector is inferred to be a remote BIND request over LDAP (port 389) or LDAPS (port 636).