CVE-2026-18453 PUBLISHED

389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search

Assigner: redhat
Reserved: 31.07.2026 Published: 07.09.2026 Updated: 08.09.2026

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Product Status

Vendor Red Hat
Product Red Hat Directory Server 11.7 E4S for RHEL 8
Versions Default: affected
  • unaffected from 8080020260903102346.f969626e to * (excl.)
Vendor Red Hat
Product Red Hat Directory Server 12.2 E4S for RHEL 9
Versions Default: affected
  • unaffected from 9020020260903155914.1674d574 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 10.0 Extended Update Support
Versions Default: affected
  • unaffected from 0:3.0.6-21.el10_0 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 7 Extended Lifecycle Support
Versions Default: affected
  • unaffected from 0:1.3.11.1-15.el7_9 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
  • unaffected from 8100020260904155442.25e700aa to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Versions Default: affected
  • unaffected from 8040020260901171549.96015a92 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Versions Default: affected
  • unaffected from 8040020260901171549.96015a92 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Versions Default: affected
  • unaffected from 8080020260831180218.6dbb3803 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Versions Default: affected
  • unaffected from 8080020260831180218.6dbb3803 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
  • unaffected from 0:2.8.0-10.el9_8 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Versions Default: affected
  • unaffected from 0:2.2.4-22.el9_2 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Versions Default: affected
  • unaffected from 0:2.4.5-29.el9_4 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 9.6 Extended Update Support
Versions Default: affected
  • unaffected from 0:2.6.1-24.el9_6 to * (excl.)
Vendor Red Hat
Product Red Hat Directory Server 11
Versions Default: affected
Vendor Red Hat
Product Red Hat Directory Server 12
Versions Default: affected
Vendor Red Hat
Product Red Hat Directory Server 13
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: unknown

Workarounds

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

Credits

  • Red Hat would like to thank Arthur Chan (Ada Logics) and Team (Anthropic) for reporting this issue.

References

Problem Types

  • NULL Pointer Dereference CWE