RLSA-2026:26456 (CVE-2026-9064)

Vulnerability from osv_rocky – Published: 2026-06-19 06:04 – Updated: 2026-07-03 06:06 – Source website
VLAI
Summary
Important: 389-ds-base security, bug fix, and enhancement update
Details

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

  • 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) (CVE-2026-9064)

Bug Fix(es) and Enhancement(s):

  • DS 12 does not handle escape char in bind user [rhel-10.2.z] (JIRA:Rocky Linux-170271)

  • dnaSharedConfig: "dnaPortNum: 0" [rhel-10.2.z] (JIRA:Rocky Linux-170276)

  • Memory leaks in syncrepl plugin during persistent search operations [rhel-10.2.z] (JIRA:Rocky Linux-170281)

  • access log - suspicious wtime optime negative and large values in internal op [rhel-10.2.z] (JIRA:Rocky Linux-170363)

  • An online reinitialization with LMDB is terminating the receiving server [rhel-10.2.z] (JIRA:Rocky Linux-170478)

  • dsctl healthcheck DSMOLE0001 inaccurate recommendations when there is more than 1 LDAP backend [rhel-10.2.z] (JIRA:Rocky Linux-170481)

  • Possible memory leak when using the Retro Changelog plugin. [rhel-10.2.z] (JIRA:Rocky Linux-170515)

  • [RFE] Add OS-level thread names to all server threads [rhel-10.2.z] (JIRA:Rocky Linux-174526)

  • Online export is failing when using the option "-s" [rhel-10.2.z] (JIRA:Rocky Linux-180718)

  • Server shutdown during online reindex may lead to data loss [rhel-10.2.z] (JIRA:Rocky Linux-183897)

  • Error: NssSsl.add_cert() got an unexpected keyword argument 'input_file' [rhel-10.2.z] (JIRA:Rocky Linux-183898)

  • Replication errors in logs [rhel-10.2.z] (JIRA:Rocky Linux-183899)

  • Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured [rhel-10.2.z] (JIRA:Rocky Linux-183900)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Credits
Rocky Enterprise Software Foundation
Red Hat
References
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:10",
        "name": "389-ds-base",
        "purl": "pkg:rpm/rocky-linux/389-ds-base?distro=rocky-linux-10\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "AppStream"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:3.2.0-7.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:26456"
  },
  "details": "389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.\n\nSecurity Fix(es):\n\n* 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) (CVE-2026-9064)\n\nBug Fix(es) and Enhancement(s):\n\n* DS 12 does not handle escape char in bind user [rhel-10.2.z] (JIRA:Rocky Linux-170271)\n\n* dnaSharedConfig: \"dnaPortNum: 0\" [rhel-10.2.z] (JIRA:Rocky Linux-170276)\n\n* Memory leaks in syncrepl plugin during persistent search operations [rhel-10.2.z] (JIRA:Rocky Linux-170281)\n\n* access log - suspicious wtime  optime negative and large values in internal op [rhel-10.2.z] (JIRA:Rocky Linux-170363)\n\n* An online reinitialization with LMDB is terminating the receiving server [rhel-10.2.z] (JIRA:Rocky Linux-170478)\n\n* dsctl healthcheck DSMOLE0001 inaccurate recommendations when there is more than 1 LDAP backend [rhel-10.2.z] (JIRA:Rocky Linux-170481)\n\n* Possible memory leak when using the Retro Changelog plugin. [rhel-10.2.z] (JIRA:Rocky Linux-170515)\n\n* [RFE] Add OS-level thread names to all server threads [rhel-10.2.z] (JIRA:Rocky Linux-174526)\n\n* Online export is failing when using the option \"-s\" [rhel-10.2.z] (JIRA:Rocky Linux-180718)\n\n* Server shutdown during online reindex may lead to data loss [rhel-10.2.z] (JIRA:Rocky Linux-183897)\n\n* Error: NssSsl.add_cert() got an unexpected keyword argument \u0027input_file\u0027 [rhel-10.2.z] (JIRA:Rocky Linux-183898)\n\n* Replication errors in logs [rhel-10.2.z] (JIRA:Rocky Linux-183899)\n\n* Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured [rhel-10.2.z] (JIRA:Rocky Linux-183900)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:26456",
  "modified": "2026-07-03T06:06:06.946424Z",
  "published": "2026-06-19T06:04:41.448408Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:26456"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480093"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:26456"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: 389-ds-base security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-9064"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.