Executive brief
389 Directory Server is an enterprise-grade LDAP server used to manage user identities and network resources. A flaw in its 'dereference control' plugin allows an unauthenticated attacker to crash the server by sending a specific search request when the system is low on memory. This can lead to a denial-of-service, disrupting login services and application access across the organization.
Technical details
A NULL pointer dereference vulnerability exists in the dereference control plugin of 389 Directory Server (389-ds-base). The root cause is a failure in the deref_parse_ctrl_value() function (deref.c) to check the return value of ber_init() for NULL before use. An unauthenticated remote attacker can trigger this by sending an LDAP search request containing a dereference control. If the system is under memory pressure and the allocation fails, the ns-slapd process will crash (SIGABRT or SIGSEGV). The dereference plugin is enabled by default, and the vulnerability has been present since version 1.2.6.
Affected products
- Red Hat 389 Directory Server 1.2.6 and later
Timeline
- 2026-06-05: disclosed: Reported via Red Hat Bugzilla
- 2026-06-09: advisory: NVD and Red Hat published advisory details