CVE-2026-18663

Name of the Vulnerable Software and Affected Versions 389-ds-base (affected versions not specified)

Description A flaw exists where the get ldapmessage controls ext() function frees the parsed controls array during the Session Tracking critical-control rejection path but fails to clear the SLAPI REQCONTROLS pblock slot. This leads to a double-free when the operation teardown process attempts to free the same pointer again. An unauthenticated remote attacker can trigger this condition by sending a single BIND request containing a critical Session Tracking control, which may result in heap corruption and a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.