389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser

Summary

A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.

Timeline

1. Jun 9, 2026, 1:02 PM UTCCVE published
2. Jun 9, 2026, 3:11 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 8, 2026, 2:15 PM UTCRecord last updated

Affected versions

• redhat-ds:11

  Version range not reported

• redhat-ds:11

  Version range not reported

• redhat-ds:11

  Version range not reported

• redhat-ds:12

  Version range not reported

• redhat-ds:12

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• redhat-ds:12/389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

References 18