CVE-2026-18453: 389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search
A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of service.
Other sources
A flaw was found in 389 Directory Server. The opsharedsearch function in opshared.c does not check for a NULL backend pointer when reusing a paged-results slot in the bename (USEONEBACKEND control) code path. An unauthenticated client can exploit this by sending two SEARCH requests on the same connection: the first names a non-existent backend via the USEONEBACKEND control with a Simple Paged Results (SPR) empty cookie, storing NULL as the backend in a paged-results slot; the second names a valid backend with an SPR cookie referencing that slot, causing the server to retrieve the stored NULL and call slapibeRlock(NULL), which dereferences the NULL pointer and crashes the ns-slapd process. This is reachable pre-authentication because control and paged-results processing runs before search authorization. Paged results and anonymous access are both enabled by default.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Is a default 389 Directory Server deployment exposed?
Yes. Both paged results and anonymous access are enabled by default, and the vulnerable processing occurs before search authorization.
Does exploitation require LDAP credentials or prior access?
No. An unauthenticated remote client can trigger the issue over a single LDAP connection by sending two crafted SEARCH requests that use the USE_ONE_BACKEND and Simple Paged Results controls.
What is the expected impact if exploitation succeeds?
The ns-slapd process crashes when it dereferences a stored NULL backend pointer. The documented impact is denial of service; no confidentiality or integrity impact is specified.