# CVE-2026-9064: 389 Directory Server denial of service via unbounded LDAP controls

Source: https://junglewise.ai/threats/cve-2026-9064-389-directory-server-denial-of-service-via-unbounded-ldap-controls  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-9064 · Severity: high · CVSS 7.5 · Published 2026-05-20

A vulnerability in the 389 Directory Server, a popular enterprise-grade LDAP server, allows an attacker to crash or slow down the service. By sending a specially crafted request with an excessive number of internal instructions, an attacker can force the server to consume all available memory and processor power. This can be done without a username or password, potentially leading to a total service outage for all users and applications that rely on the directory for authentication.

Technologies: [389 Directory Server Project Directory Server](https://junglewise.ai/threats/technologies/directory-server). Vendors: [389 Directory Server Project](https://junglewise.ai/threats/vendors/389-directory-server-project).

## Quick answers

**Is CVE-2026-9064 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9064 being exploited in the wild.

**How severe is CVE-2026-9064?** High severity, with a CVSS score of 7.5, published 20 May 2026.

**Which products and versions are affected?** 389 Directory Server Project 389-ds-base.

**Is there a fix for CVE-2026-9064?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9064 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-9064?** Check whether you run 389 Directory Server Project Directory Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the get_ldapmessage_controls_ext() function within ldap/servers/slapd/control.c of 389-ds-base. The server fails to enforce an upper bound on the number of LDAP controls processed per message, leading to a CWE-770 (Allocation of Resources Without Limits or Throttling) condition. An unauthenticated attacker can exploit this by sending a request (such as a Bind request) containing hundreds of thousands of minimal controls within the default 2MB message size limit. This results in repeated heap reallocations and high CPU usage, causing worker thread starvation, significant latency spikes, or out-of-memory (OOM) termination.

## Affected products

- 389 Directory Server Project 389-ds-base

## Timeline

- 2026-05-20: disclosed: Initial report by Oleh Konko of 1seal.org
- 2026-05-20: advisory: NVD and Red Hat advisories published

## References

- [https://access.redhat.com/security/cve/CVE-2026-9064](https://access.redhat.com/security/cve/CVE-2026-9064)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2480093](https://bugzilla.redhat.com/show_bug.cgi?id=2480093)

## Related threats

- [389 Directory Server heap overflow in DN normalization](https://junglewise.ai/threats/cve-2026-14940-389-directory-server-heap-overflow-in-dn-normalization)