A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade 389-ds-base-bdbUpgrade 389-ds-base-debuginfoUpgrade 389-ds-base-bdb-debuginfoUpgrade 389-ds-base-legacy-toolsUpgrade 389-ds-base-develUpgrade 389-ds-baseUpgrade 389-ds-base-legacy-tools-debuginfoUpgrade 389-ds-base-debugsourceUpgrade 389-ds-base-libs-debuginfoUpgrade 389-ds-base-snmp-debuginfoUpgrade 389-ds-base-snmpNo solution existsUpgrade python3-lib389Upgrade 389-ds-base-libs | Jul 17, 2026 | Apr 16, 2026 |
| Rocky_linux | — | Upgrade 389-ds-base-legacy-toolsUpgrade 389-ds-base-snmpUpgrade 389-ds-base-debugsourceUpgrade 389-ds-base-debuginfoUpgrade 389-ds-base-develUpgrade 389-ds-base-legacy-tools-debuginfoUpgrade 389-ds-base-bdbUpgrade 389-ds-baseUpgrade 389-ds-base-libsUpgrade 389-ds-base-bdb-debuginfoUpgrade 389-ds-base-snmp-debuginfoUpgrade 389-ds-base-libs-debuginfo | Aug 20, 2026 | Aug 17, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub