CVE catalog

CVE-2026-9064

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: May 20, 2026, 7:30:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.81% · Oct 25, 2026

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	389-ds-base	sid	`3.3.1-3`	fixed
Debian	389-ds-base	trixie	`3.1.2+dfsg1-1+deb13u1`	vulnerable
Debian	389-ds-base	bookworm	`2.3.1+dfsg1-1+deb12u1`	vulnerable
Cpe	389-ds-base	Not reported	Not reported	vulnerable
Cpe	directory_server	Not reported	Not reported	unknown
Cpe	389_directory_server	Not reported	Not reported	unknown
Cpe	enterprise_linux	Not reported	Not reported	unknown
Cpe	directory_server	Not reported	Not reported	unknown
Cpe	389_directory_server	Not reported	Not reported	unknown
Cpe	enterprise_linux	Not reported	Not reported	unknown
Suse	389-ds	linux enterprise module for server applications 15 sp7	`2.7.0~git193.9ab79d496-150700.3.16.1`	fixed
Suse	389-ds	linux enterprise server 15 sp6-ltss	`2.2.10~git229.1fa7ffdb4-150600.8.29.1`	fixed
Suse	389-ds	linux enterprise server for sap applications 15 sp6	`2.2.10~git229.1fa7ffdb4-150600.8.29.1`	fixed
Suse	389-ds	linux enterprise high performance computing 15 sp5-espos	`2.2.10~git229.1fa7ffdb4-150500.3.45.1`	fixed
Suse	389-ds	linux enterprise high performance computing 15 sp5-ltss	`2.2.10~git229.1fa7ffdb4-150500.3.45.1`	fixed
Suse	389-ds	linux enterprise server 15 sp5-ltss	`2.2.10~git229.1fa7ffdb4-150500.3.45.1`	fixed
Suse	389-ds	linux enterprise server for sap applications 15 sp5	`2.2.10~git229.1fa7ffdb4-150500.3.45.1`	fixed
Suse	389-ds	linux enterprise high performance computing 15 sp4-espos	`2.0.20~git90.9f70d434e-150400.3.51.1`	fixed
Suse	389-ds	linux enterprise high performance computing 15 sp4-ltss	`2.0.20~git90.9f70d434e-150400.3.51.1`	fixed
Suse	389-ds	linux enterprise server 15 sp4-ltss	`2.0.20~git90.9f70d434e-150400.3.51.1`	fixed
Suse	389-ds	linux enterprise server for sap applications 15 sp4	`2.0.20~git90.9f70d434e-150400.3.51.1`	fixed
Opensuse	389-ds	tumbleweed	`3.1.4+e9d94d45a-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	389-ds-base	source	sid	`3.3.0-1`	not yet assigned	Not reported	[1137436]
Debian	389-ds-base	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1137436]
Debian	389-ds-base	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1137436]
Suse	389-ds	rpm	linux enterprise module for server applications 15 sp7	`2.7.0~git193.9ab79d496-150700.3.16.1`	Not reported	SUSE-SU-2026:2419-1	Not reported
Suse	389-ds	rpm	linux enterprise server 15 sp6-ltss	`2.2.10~git229.1fa7ffdb4-150600.8.29.1`	Not reported	SUSE-SU-2026:2418-1	Not reported
Suse	389-ds	rpm	linux enterprise server for sap applications 15 sp6	`2.2.10~git229.1fa7ffdb4-150600.8.29.1`	Not reported	SUSE-SU-2026:2418-1	Not reported
Suse	389-ds	rpm	linux enterprise high performance computing 15 sp5-espos	`2.2.10~git229.1fa7ffdb4-150500.3.45.1`	Not reported	SUSE-SU-2026:2417-1	Not reported
Suse	389-ds	rpm	linux enterprise high performance computing 15 sp5-ltss	`2.2.10~git229.1fa7ffdb4-150500.3.45.1`	Not reported	SUSE-SU-2026:2417-1	Not reported
Suse	389-ds	rpm	linux enterprise server 15 sp5-ltss	`2.2.10~git229.1fa7ffdb4-150500.3.45.1`	Not reported	SUSE-SU-2026:2417-1	Not reported
Suse	389-ds	rpm	linux enterprise server for sap applications 15 sp5	`2.2.10~git229.1fa7ffdb4-150500.3.45.1`	Not reported	SUSE-SU-2026:2417-1	Not reported
Suse	389-ds	rpm	linux enterprise high performance computing 15 sp4-espos	`2.0.20~git90.9f70d434e-150400.3.51.1`	Not reported	SUSE-SU-2026:2316-1	Not reported
Suse	389-ds	rpm	linux enterprise high performance computing 15 sp4-ltss	`2.0.20~git90.9f70d434e-150400.3.51.1`	Not reported	SUSE-SU-2026:2316-1	Not reported
Suse	389-ds	rpm	linux enterprise server 15 sp4-ltss	`2.0.20~git90.9f70d434e-150400.3.51.1`	Not reported	SUSE-SU-2026:2316-1	Not reported
Suse	389-ds	rpm	linux enterprise server for sap applications 15 sp4	`2.0.20~git90.9f70d434e-150400.3.51.1`	Not reported	SUSE-SU-2026:2316-1	Not reported
Opensuse	389-ds	rpm	tumbleweed	`3.1.4+e9d94d45a-1.1`	Not reported	OPENSUSE-SU-2026:10870-1	Not reported

[Debian bug #1137436]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[389-ds]Affected
Source package: [389-ds-base]
Details (2)
- 2.3.1+dfsg1-1+deb12u1 · all · bookworm
  Affected
  nvd · 389-ds-base · debian · bookworm; nvd · 389-ds-base · debian · 12
- 2.3.1+dfsg1-1+deb12u1 · all · bookworm
  Affected
  nvd · 389-ds-base · debian · bookworm; nvd · 389-ds-base · debian · 12
[389-ds-base]Affected
Details (2)
- 2.3.1+dfsg1-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · 389-ds-base · debian · bookworm; nvd · 389-ds-base · debian · 12
- 2.3.1+dfsg1-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · 389-ds-base · debian · bookworm; nvd · 389-ds-base · debian · 12
[389-ds-base-dev]Affected
Source package: [389-ds-base]
Details (2)
- 2.3.1+dfsg1-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · 389-ds-base · debian · bookworm; nvd · 389-ds-base · debian · 12
- 2.3.1+dfsg1-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · 389-ds-base · debian · bookworm; nvd · 389-ds-base · debian · 12
[389-ds-base-libs]Affected
Source package: [389-ds-base]
Details (2)
- 2.3.1+dfsg1-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · 389-ds-base · debian · bookworm; nvd · 389-ds-base · debian · 12
- 2.3.1+dfsg1-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · 389-ds-base · debian · bookworm; nvd · 389-ds-base · debian · 12
[cockpit-389-ds]Affected
Source package: [389-ds-base]
Details (2)
- 2.3.1+dfsg1-1+deb12u1 · all · bookworm
  Affected
  nvd · 389-ds-base · debian · bookworm; nvd · 389-ds-base · debian · 12
- 2.3.1+dfsg1-1+deb12u1 · all · bookworm
  Affected
  nvd · 389-ds-base · debian · bookworm; nvd · 389-ds-base · debian · 12
[python3-lib389]Affected
Source package: [389-ds-base]
Details (2)
- 2.3.1+dfsg1-1+deb12u1 · all · bookworm
  Affected
  nvd · 389-ds-base · debian · bookworm; nvd · 389-ds-base · debian · 12
- 2.3.1+dfsg1-1+deb12u1 · all · bookworm
  Affected
  nvd · 389-ds-base · debian · bookworm; nvd · 389-ds-base · debian · 12

[Debian 13 (Trixie)]

[389-ds]Affected
Source package: [389-ds-base]
Details (2)
- 3.1.2+dfsg1-1+deb13u1 · all · trixie
  Affected
  nvd · 389-ds-base · debian · 13
- 3.1.2+dfsg1-1+deb13u1 · all · trixie
  Affected
  nvd · 389-ds-base · debian · 13
[389-ds-base]Affected
Details (2)
- 3.1.2+dfsg1-1+deb13u1 · amd64 · trixie
  Affected
  nvd · 389-ds-base · debian · 13
- 3.1.2+dfsg1-1+deb13u1 · arm64 · trixie
  Affected
  nvd · 389-ds-base · debian · 13
[389-ds-base-dev]Affected
Source package: [389-ds-base]
Details (2)
- 3.1.2+dfsg1-1+deb13u1 · amd64 · trixie
  Affected
  nvd · 389-ds-base · debian · 13
- 3.1.2+dfsg1-1+deb13u1 · arm64 · trixie
  Affected
  nvd · 389-ds-base · debian · 13
[389-ds-base-libs]Affected
Source package: [389-ds-base]
Details (2)
- 3.1.2+dfsg1-1+deb13u1 · amd64 · trixie
  Affected
  nvd · 389-ds-base · debian · 13
- 3.1.2+dfsg1-1+deb13u1 · arm64 · trixie
  Affected
  nvd · 389-ds-base · debian · 13
[cockpit-389-ds]Affected
Source package: [389-ds-base]
Details (2)
- 3.1.2+dfsg1-1+deb13u1 · all · trixie
  Affected
  nvd · 389-ds-base · debian · 13
- 3.1.2+dfsg1-1+deb13u1 · all · trixie
  Affected
  nvd · 389-ds-base · debian · 13
[python3-lib389]Affected
Source package: [389-ds-base]
Details (2)
- 3.1.2+dfsg1-1+deb13u1 · all · trixie
  Affected
  nvd · 389-ds-base · debian · 13
- 3.1.2+dfsg1-1+deb13u1 · all · trixie
  Affected
  nvd · 389-ds-base · debian · 13

[openSUSE Tumbleweed]

[389-ds-devel]Unknown
Source package: [389-ds]
Details (1)
- 3.2.2+4b41542b2-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.4+e9d94d45a-1.1
  Version impact unknown
  nvd · 389-ds · opensuse · tumbleweed
[389-ds-snmp]Unknown
Source package: [389-ds]
Details (1)
- 3.2.2+4b41542b2-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.4+e9d94d45a-1.1
  Version impact unknown
  nvd · 389-ds · opensuse · tumbleweed
[lib389]Unknown
Source package: [389-ds]
Details (1)
- 3.2.2+4b41542b2-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.4+e9d94d45a-1.1
  Version impact unknown
  nvd · 389-ds · opensuse · tumbleweed
[libsvrcore0]Unknown
Source package: [389-ds]
Details (1)
- 3.2.2+4b41542b2-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.4+e9d94d45a-1.1
  Version impact unknown
  nvd · 389-ds · opensuse · tumbleweed
[389-ds]Fixed
Source package: [389-ds]
Details (1)
- 3.2.2+4b41542b2-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 3.1.4+e9d94d45a-1.1
  nvd · 389-ds · opensuse · tumbleweed

Observed: Oct 23, 2026, 10:02:52 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]