CVE-2026-9064

Name of the Vulnerable Software and Affected Versions 389-ds-base (affected versions not specified)

Description A flaw exists in the LDAP server where the get ldapmessage controls ext() function fails to enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER (Basic Encoding Rules) message size of 2 MB. This causes excessive CPU consumption and heap allocation. Concurrent exploitation can lead to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.