Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
9 versions affected across 3 products
CVE-2026-9064 no 389-ds-base: atacante remoto pode derrubar seu servidor LDAP com uma única requisição. Rocky Linux 10 afetado. Saiba mais: -> http://shorturl.at/90BYG #RockyLinux https://t.co/4vdg7WrjXL
Post summary
A new CVE affecting Rocky Linux 10 is announced, noting a denial‑of‑service impact on LDAP with a single request, but no PoC, exploit code, or patch information is provided.
9 of 9 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | redhat | 389_directory_server | - | - | - |
| App | redhat | directory_server | 11.0 | - | - |
| App | redhat | directory_server | 12.0 | - | - |
| App | redhat | directory_server | 13.0 | - | - |
| OS | redhat | enterprise_linux | 10.0 | - | - |
| OS | redhat | enterprise_linux | 6.0 | - | - |
| OS | redhat | enterprise_linux | 7.0 | - | - |
| OS | redhat | enterprise_linux | 8.0 | - | - |
| OS | redhat | enterprise_linux | 9.0 | - | - |