CVE-2026-18663: 389 Directory Server DoS Vulnerability

CVE-2026-18663 Overview

CVE-2026-18663 is a double-free vulnerability [CWE-415] in the 389-ds-base LDAP directory server. The flaw resides in the get_ldapmessage_controls_ext() function, which frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPI_REQCONTROLS pblock slot. Operation teardown then frees the same pointer a second time, causing heap corruption. An unauthenticated remote attacker can trigger the condition by sending a single BIND request carrying a critical Session Tracking control, leading to denial of service against the directory service.

Critical Impact
Unauthenticated remote attackers can crash the 389-ds-base directory server with a single crafted LDAP BIND request, disrupting authentication services that depend on it.

Affected Products

389-ds-base (Red Hat Directory Server upstream project)
Red Hat Directory Server distributions incorporating the vulnerable get_ldapmessage_controls_ext() code path
Downstream Linux distributions packaging 389-ds-base — refer to the Red Hat CVE-2026-18663 Advisory for version details

Discovery Timeline

2026-08-12 - CVE-2026-18663 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18663

Vulnerability Analysis

The vulnerability affects 389-ds-base LDAP request processing. When the server parses LDAP controls attached to an incoming request, get_ldapmessage_controls_ext() handles the Session Tracking control per RFC-defined semantics. If the Session Tracking control is marked critical and the server rejects it, the function frees the parsed controls array as part of its error path.

The error path fails to clear the SLAPI_REQCONTROLS slot of the parameter block (pblock) that holds a reference to the same array. When the operation later reaches teardown, standard cleanup logic frees the pointer stored in SLAPI_REQCONTROLS a second time. The resulting double-free corrupts heap metadata.

The most reliable outcome is a server crash, producing a denial of service. Depending on allocator state and adjacent allocations, heap corruption can create secondary conditions that affect service integrity.

Root Cause

The root cause is inconsistent ownership tracking between an error-handling routine and the operation teardown code. get_ldapmessage_controls_ext() releases the controls array without invalidating the shared pointer in the pblock, breaking the invariant that a freed pointer must not remain referenced elsewhere in the request context.

Attack Vector

Exploitation requires only network access to the LDAP service. An unauthenticated attacker sends a BIND request carrying a Session Tracking control with the criticality flag set. The server enters the rejection path, frees the controls array, and later triggers the second free during operation cleanup. No credentials, user interaction, or prior state are required.

The vulnerability manifests through the LDAP protocol. See the Red Hat Bug Report #2510631 for technical details on the affected code path.

Detection Methods for CVE-2026-18663

Indicators of Compromise

Unexpected ns-slapd process crashes or restarts in system logs and systemd journal entries
Core dumps from the 389-ds-base process referencing get_ldapmessage_controls_ext or heap-corruption abort traces (for example, malloc(): double free detected)
LDAP access logs showing BIND operations followed by abrupt connection termination without a normal result code

Detection Strategies

Inspect LDAP protocol traffic for BIND requests carrying the Session Tracking control OID (1.3.6.1.4.1.21008.108.63.1) with the criticality flag set to TRUE
Correlate directory server process termination events with immediately preceding LDAP BIND traffic from the same client
Enable and review 389-ds-base error logs at a verbosity that captures control parsing rejections

Monitoring Recommendations

Alert on repeated ns-slapd restarts within short time windows, which indicate probing or exploitation attempts
Monitor for anomalous volumes of BIND requests from single sources targeting directory servers
Collect and centralize directory server logs and core dumps in a SIEM or data lake for retrospective analysis

How to Mitigate CVE-2026-18663

Immediate Actions Required

Apply vendor-supplied 389-ds-base patches once available from your Linux distribution
Restrict network access to the LDAP service (typically TCP 389 and 636) using firewall rules that allow only trusted clients
Enable automatic restart of the dirsrv service via systemd to reduce downtime from crashes while patching is scheduled

Patch Information

Consult the Red Hat CVE-2026-18663 Advisory for fixed package versions and errata identifiers. Downstream distributions such as Fedora and other rebuilds will publish updated 389-ds-base packages that clear the SLAPI_REQCONTROLS pblock slot in the rejection path or otherwise correct the ownership handling.

Workarounds

Limit LDAP exposure by binding the directory server to internal management networks only
Place the directory server behind an LDAP proxy or load balancer that can filter or strip unknown critical controls before they reach the backend
Increase monitoring and alerting on directory server availability so that exploitation attempts are detected and remediated quickly

bash

# Example: restrict LDAP access to trusted subnets using firewalld
sudo firewall-cmd --permanent --zone=public --remove-service=ldap
sudo firewall-cmd --permanent --zone=public --remove-service=ldaps
sudo firewall-cmd --permanent --new-zone=ldap-trusted
sudo firewall-cmd --permanent --zone=ldap-trusted --add-source=10.0.0.0/24
sudo firewall-cmd --permanent --zone=ldap-trusted --add-service=ldap
sudo firewall-cmd --permanent --zone=ldap-trusted --add-service=ldaps
sudo firewall-cmd --reload

# Ensure the directory server restarts automatically after a crash
sudo systemctl edit dirsrv@<instance>.service
# Add under [Service]:
#   Restart=on-failure
#   RestartSec=5s
sudo systemctl daemon-reload