PT-2026-42138 · Red Hat · Red Hat Directory Server 11+7

Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-9064

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A flaw was found in 389-ds-base. The get ldapmessage controls ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-9064

Affected Products

Red Hat Directory Server 11

Red Hat Directory Server 12

Red Hat Directory Server 13

Red Hat Enterprise Linux 10

Red Hat Enterprise Linux 6

Red Hat Enterprise Linux 7

Red Hat Enterprise Linux 8

Red Hat Enterprise Linux 9

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-9064 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2480093 · Note
• https://access.redhat.com/security/cve/CVE-2026-9064 · Note