389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search

Summary

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.

Timeline

1. Sep 7, 2026, 2:14 PM UTCCVE published
2. Sep 9, 2026, 2:40 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Oct 8, 2026, 2:14 PM UTCRecord last updated

Affected versions

• redhat-ds:11

  Version range not reported

• redhat-ds:11

  Version range not reported

• redhat-ds:11

  Version range not reported

• redhat-ds:12

  Version range not reported

• redhat-ds:12

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• dirsrv/dirsrv-container-rhel10

  Version range not reported

• redhat-ds:12/389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

References 19