CyberSec Daily ✓ · 🗄️ Directory Security · 13 August 2026 🎯 New pre-authentication flaw disclosed in 389 Directory Server Red Hat has disclosed CVE-2026-18663, a memory-management vulnerability affecting 389 Directory Server 3.x. A remote attacker does not need authentication to reach the vulnerable code path. The flaw can cause a double-free and heap corruption, creating a potential denial-of-service condition. There is an important limitation: Red Hat's testing found its RHEL 10 and Red Hat Directory Server 13 builds continued running because of their memory allocator, and no privilege escalation or information disclosure has been demonstrated. Red Hat therefore rates the issue Moderate, CVSS 5.9, despite the pre-authentication attack surface. 🔗 Source: Red Hat Product Security #LDAP #389DirectoryServer #LinuxSecurity #CVE #CyberSecurity
Post summary
Red Hat disclosed CVE‑2026‑18663, a memory‑management flaw in 389 Directory Server that allows unauthenticated attackers to trigger a double‑free and potential Denial‑of‑Service, with no active exploitation or patch mentioned.