REDHAT-BUG-2485423: Medium severity Red Hat 389-ds-base vulnerability

Published Jun 5, 2026

Updated

The dereference control plugin in 389 Directory Server fails to check the return value of berinit() for NULL before use in derefparsectrlvalue() (deref.c). When memory allocation fails under memory pressure, an unauthenticated LDAP client sending a search with the deref control can crash ns-slapd.

The deref plugin is enabled by default. Crash confirmed via GDB fault injection on Fedora 42 (SIGABRT) and CentOS 7 (SIGSEGV on OpenLDAP 2.4). Vulnerable code present since deref plugin introduction in 389-ds-base 1.2.6 (~2010).

Affected Software

1 affected component

Red Hat 389-ds-base>=1.2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Disable the deref plugin (dereference control plugin) since it is enabled by default and is the vulnerable code path in deref_parse_ctrl_value() in deref.c.

Event History

Jun 5, 2026

Data Sourced

via Red Hat·12:25 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2485423?

The severity of REDHAT-BUG-2485423 is medium, rated at 4.

What issues does REDHAT-BUG-2485423 cause?

REDHAT-BUG-2485423 can lead to a crash of the ns-slapd service when an unauthenticated LDAP client sends a specific search request.

How can I mitigate REDHAT-BUG-2485423?

To mitigate REDHAT-BUG-2485423, ensure that your system has adequate memory resources and monitor for any signs of memory pressure.

Who is affected by REDHAT-BUG-2485423?

Users of the Red Hat 389-ds-base are affected by REDHAT-BUG-2485423.

How do I resolve REDHAT-BUG-2485423?

To resolve REDHAT-BUG-2485423, apply the latest updates or patches provided by Red Hat for the 389 Directory Server.