What’s Vulnerable › Vulnerabilities

CVE-2026-18663: 389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking control

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-12 · updated 2026-08-14
• Weakness: CWE-415

Description

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPI_REQCONTROLS pblock slot. Operation teardown then frees the same pointer again, causing a double-free. An unauthenticated remote attacker can trigger this with a single BIND request carrying a critical Session Tracking control, resulting in heap corruption and potential denial of service.

Affected products

• Red Hat Directory Server 13: all versions
• Red Hat Enterprise Linux 10: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-18663
• https://bugzilla.redhat.com/show_bug.cgi?id=2510631

Get alerted when CVE-2026-18663 or the next vulnerability affects your stack