Executive brief
389 Directory Server is an enterprise-grade LDAP server used for managing user identities and access. A flaw in how the server handles updates to its internal data structure (schema) can cause the system to crash if an administrator reloads the schema while the server is actively processing user queries. This results in a denial of service, potentially disrupting authentication and directory services for the entire organization.
Technical details
A use-after-free (UAF) vulnerability exists in the 389 Directory Server's 'attr_syntax_swap_ht()' function within 'attrsyntax.c'. During a schema reload, this function unconditionally frees attribute syntax information nodes, bypassing the standard reference-counting mechanism used for deferred deletion. If an administrator triggers a schema reload (e.g., via 'dsconf' or LDAP modification) while concurrent LDAP queries are active, worker threads may attempt to access the freed memory. This race condition can result in a SIGSEGV crash (double-free or UAF). The vulnerability is present in versions supporting dynamic schema reload and requires administrative privileges to trigger the reload.
Affected products
- 389ds 389 Directory Server All versions with dynamic schema reload support
- Red Hat Red Hat Directory Server 11
- Red Hat Red Hat Directory Server 12
- Red Hat Red Hat Directory Server 13
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
Timeline
- 2026-06-05: disclosed: Reported via Red Hat Bugzilla
- 2026-06-18: advisory: NVD and Red Hat published advisory details