CVE-2026-9064: 389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)
A flaw was found in 389-ds-base. The getldapmessagecontrolsext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.
Other sources
A vulnerability was found in 389-ds-base (389 Directory Server). The function getldapmessagecontrolsext() in ldap/servers/slapd/control.c parses the optional LDAP v3 Controls field via a decode loop that allocates one LDAPControl struct per control element and grows the pointer list with repeated reallocations, but does not enforce a hard upper bound on the number of controls per message.
Under the default nsslapd-maxbersize of 2097152 (2 MB), a remote unauthenticated client can encode hundreds of thousands of minimal non-critical controls in a single LDAP request, forcing attacker-amplified CPU time and heap allocation. The control parsing occurs pre-authentication (e.g., during Bind request processing at bind.c:227), meaning no credentials are required to trigger the vulnerability.
Concurrency testing shows that with 4 concurrent 400000-controls Bind requests, heavy requests frequently exceed a 10-second client-side timeout, and independent small probes see latency spikes (baseline p50 ~3ms to stress p50 ~45ms). Sustained pressure can cause worker starvation or OOM termination.
This vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), similar in pattern to CVE-2019-10171 in 389-ds-base.
Upstream repository: https://github.com/389ds/389-ds-base Callsite: ldap/servers/slapd/control.c, function getldapmessagecontrolsext(), line 382-383 Bind entry: ldap/servers/slapd/bind.c, line 227 Confirmed at commit: 761452f79c30bbfd0d6756c4a8ed39549fde5717
Reported by: Oleh Konko of 1seal.org (security) Original report: PSIRTSUPT-6092
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
389-ds-baseto a version that resolves this vulnerability.Patch 761452f79c30bbfd0d6756c4a8ed39549fde5717
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9064?
CVE-2026-9064 is classified as a high severity vulnerability due to its potential for causing remote denial of service through CPU and heap amplification.
How do I fix CVE-2026-9064?
To mitigate CVE-2026-9064, upgrade to a patched version of 389-ds-base that enforces limits on the number of LDAP controls.
What versions of 389-ds-base are affected by CVE-2026-9064?
CVE-2026-9064 affects all versions of 389-ds-base prior to the introduction of the fix that limits unbounded LDAP controls.
What impact does CVE-2026-9064 have on my system?
CVE-2026-9064 can lead to resource exhaustion, resulting in denial of service for the LDAP server, making it unavailable to legitimate users.
Is CVE-2026-9064 actively exploited in the wild?
As of now, there are no public reports indicating active exploitation of CVE-2026-9064, but it remains a significant risk.