A remote denial-of-service vulnerability (CVE-2026-9064, CVSS 7.5 HIGH) exists in 389-ds-base where an attacker can cause excessive CPU and heap usage by sending an LDAP message with an unbounded number of controls via the `get_ldapmessage_controls_ext()` function. The NVD lists affected versions as Red Hat Directory Server 11.0, 12.0, and 13.0, as well as Red Hat Enterprise Linux 6.0. The security update for Red Hat Enterprise Linux 8 is provided in the 389-ds:1.4 module update, specifically version 389-ds-base-1.4.3.39-24.
Red Hat Product Errata RHSA-2026:26459 - Security Advisory Issued: 2026-06-17 Updated: 2026-06-17 RHSA-2026:26459 - Security Advisory Overview Updated Packages Synopsis Important: 389-ds:1.4 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for the 389-ds:1.4 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description 389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) (CVE-2026-9064) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2480093 - CVE-2026-9064 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) RHEL-163375 - WARN - keys2idl - received NULL idl from index_read_ext_allids CVEs CVE-2026-9064 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM 389-ds-base-1.4.3.39-24.module+el8.10.0+24340+7270ac72.src.rpm SHA-256: 6cf8621de28813dc33a49649417b9c6b151476d0f01fb4c7ec802af67a9e0f39 x86_64 python3-lib389-1.4.3.39-24.module+el8.10.0+24340+7270ac72.noarch.rpm SHA-256: c50442b47bb21bdc6997a5ba44862ed6946882ee8c871ff9a739883aea3f940f python3-lib389-1.4.3.39-24.module+el8.10.0+24340+7270ac72.noarch.rpm SHA-256: c50442b47bb21bdc6997a5ba44862ed6946882ee8c871ff9a739883aea3f940f python3-lib389-1.4.3.39-24.module+el8.10.0+24340+7270ac72.noarch.rpm SHA-256: c50442b47bb21bdc6997a5ba44862ed6946882ee8c871ff9a739883aea3f940f 389-ds-base-1.4.3.39-24.module+el8.10.0+24340+7270ac72.x86_64.rpm SHA-256: efd69538854f8045b6907bb390a2068a2cad896f95bf8253448ce7f2488610ec 389-ds-base-debuginfo-1.4.3.39-24.module+el8.10.0+24340+7270ac72.x86_64.rpm SHA-256: 130cbe2d101f46a180e93ca6b9a0d2ca69753b8566af710e86455bed885d70a1 389-ds-base-debugsource-1.4.3.39-24.module+el8.10.0+24340+7270ac72.x86_64.rpm SHA-256: 78439844b231adb2a0e1ea8453b363d62a3ec2bf46464d6f7e251a89039de4dd 389-ds-base-devel-1.4.3.39-24.module+el8.10.0+24340+7270ac72.x86_64.rpm SHA-256: 3efd8caf3388a005929f842e629e72884d76f2fe958ee1959aac37de3fd960c6 389-ds-base-legacy-tools-1.4.3.39-24.module+el8.10.0+24340+7270ac72.x86_64.rpm SHA-256: 080d936ab0b45636528c7ec9769b55a7bd6fbb5a8602e6d437e3e7740b426cd1 389-ds-base-legacy-tools-debuginfo-1.4.3.39-24.module+el8.10.0+24340+7270ac72.x86_64.rpm SHA-256: 5072d0ef14fa6f8074fffa1fc580e8cd44454050ecf40a7e4bfe59328ab7b93d 389-ds-base-libs-1.4.3.39-24.module+el8.10.0+24340+7270ac72.x86_64.rpm SHA-256: a088f171ac1d357c3cd15893ae6ffaa11f090b8bd853a0370f2c4e37f1492c71 389-ds-base-libs-debuginfo-1.4.3.39-24.module+el8.10.0+24340+7270ac72.x86_64.rpm SHA-256: 48fb9a2dd252b15107db0a65d3e6a2d9d22e6fd25842d36dc82937cd39daf52b 389-ds-base-snmp-1.4.3.39-24.module+el8.10.0+24340+7270ac72.x86_64.rpm SHA-256: 42dd82feda69f857ae39d97be3012806ef42ea5bf79b193c26850d2bb1e53cb7 389-ds-base-snmp-debuginfo-1.4.3.39-24.module+el8.10.0+24340+7270ac72.x86_64.rpm SHA-256: 73df07c3f0b47cca608b98619f0784e7903b83fe94b9a29031e52adc4a7936f9 python3-lib389-1.4.3.39-24.module+el8.10.0+24340+7270ac72.noarch.rpm SHA-256: c50442b47bb21bdc6997a5ba44862ed6946882ee8c871ff9a739883aea3f940f Red Hat Enterprise Linux for IBM z Systems 8 SRPM 389-ds-base-1.4.3.39-24.module+el8.10.0+24340+7270ac72.src.rpm SHA-256: 6cf8621de28813dc33a49649417b9c6b151476d0f01fb4c7ec802af67a9e0f39 s390x python3-lib389-1.4.3.39-24.module+el8.10.0+24340+7270ac72.noarch.rpm SHA-256: c50442b47bb21bdc6997a5ba44862ed6946882ee8c871ff9a739883aea3f940f python3-lib389-1.4.3.39-24.module+el8.10.0+24340+7270ac72.noarch.rpm SHA-256: c50442b47bb21bdc6997a5ba44862ed6946882ee8c871ff9a739883aea3f940f 389-ds-base-1.4.3.39-24.module+el8.10.0+24340+7270ac72.s390x.rpm SHA-256: e4330dfde5153f0f1c1c8b8b405b26998303809e49d5282909e514137a66ddbb 389-ds-base-debuginfo-1.4.3.39-24.module+el8.10.0+24340+7270ac72.s390x.rpm SHA-256: 43159b4f031a699209570fd5b01410f6d2763269e6d9f16639024f09836e416e 389-ds-base-debugsource-1.4.3.39-24.module+el8.10.0+24340+7270ac72.s390x.rpm SHA-256: f91afdbe52b9708cbf65113bcf3559ad3e4954c0e370ca2bfef581c9422cb43b 389-ds-base-devel-1.4.3.39-24.module+el8.10.0+24340+7270ac72.s390x.rpm SHA-256: 2cd548b61d2e90f7df72459f0ef7f13db684dbeceaead36a713f7d1af2714d11 389-ds-base-legacy-tools-1.4.3.39-24.module+el8.10.0+24340+7270ac72.s390x.rpm SHA-256: 2fd0002db2d97ae2a6197d0865578f8f4e581bfec38f6d9d8649758b184c9357 389-ds-base-legacy-tools-debuginfo-1.4.3.39-24.module+el8.10.0+24340+7270ac72.s390x.rpm SHA-256: bc098572e431b05747055eea16201269bb2cd8ca0a6d353aaa89e4694911e9dc 389-ds-base-libs-1.4.3.39-24.module+el8.10.0+24340+7270ac72.s390x.rpm SHA-256: 4109880a79d5d9c5556d984365ba121cbfca8123cbf672a630410ec3ad60e4db 389-ds-base-libs-debuginfo-1.4.3.39-24.module+el8.10.0+24340+7270ac72.s390x.rpm SHA-256: 722a787b796b2379ffa3a7e6fe0210445a97b70ba77388956cd104b3c045ef74 389-ds-base-snmp-1.4.3.39-24.module+el8.10.0+24340+7270ac72.s390x.rpm SHA-256: 3b40481aa27def103fbddb7cf5371531572aecd583ecf0f84a487311602f0f6b 389-ds-base-snmp-debuginfo-1.4.3.39-24.module+el8.10.0+24340+7270ac72.s390x.rpm SHA-256: 8a38d17048059cbce6139c5e6992cfe0ed22feb5ad601916fe9a69c7ed8f62dd python3-lib389-1.4.3.39-24.module+el8.10.0+24340+7270ac72.noarch.rpm SHA-256: c50442b47bb21bdc6997a5ba44862ed6946882ee8c871ff9a739883aea3f940f python3-lib389-1.4.3.39-24.module+el8.10.0+24340+7270ac72.noarch.rpm SHA-256: c50442b47bb21bdc6997a5ba44862ed6946882ee8c871ff9a739883aea3f940f Red Hat Enterprise Linux for Power, little endian 8 SRPM 389-ds-base-1.4.3.39-24.module+el8.10.0+24340+7270ac72.src.rpm SHA-256: 6cf8621de28813dc33a49649417b9c6b151476d0f01fb4c7ec802af67a9e0f39 ppc64le python3-lib389-1.4.3.39-24.module+el8.10.0+24340+7270ac72.noarch.rpm SHA-256: c50442b47bb21bdc6997a5ba44862ed6946882ee8c871ff9a739883aea3f940f 389-ds-base-1.4.3.39-24.module+el8.10.0+24340+7270ac72.ppc64le.rpm SHA-256: 79653baa875e20578a9ef0019a822aebcdd9fb03f38b4bddb364c9884e0db1ed 389-ds-base-debuginfo-1.4.3.39-24.module+el8.10.0+24340+7270ac72.ppc64le.rpm SHA-256: 6e03ad73d58c3194b0edab08d0d2a3fb1cc583508768bd98a8bafda8f6352d90 389-ds-base-debugsource-1.4.3.39-24.module+el8.10.0+24340+7270ac72.ppc64le.rpm SHA-256: 74d436dedf65b44eac7cd07a24a2bc0bb621c8b39fe0106a8324b90b3b2c13c0 389-ds-base-devel-1.4.3.39-24.module+el8.10.0+24340+7270ac72.ppc64le.rpm SHA-256: dd9daec6d2bb8e7604052b285f75ba3270ba5f765a8ce1739282820b1b4440bc 389-ds-base-legacy-tools-1.4.3.39-24.module+el8.10.0+24340+7270ac72.ppc64le.rpm SHA-256: 2598b27f402d9d6cd64f45660501a1e7a67b04d27ccf95743e33dee0bff350e8 389-ds-base-legacy-tools-debuginfo-1.4.3.39-24.module+el8.10.0+24340+7270ac72.ppc64le.rpm SHA-256: 8a5a48380306bfb53bbc91a57d0db3aefcbc128cd60f45d47ae9bf5d9f31f388 389-ds-base-libs-1.4.3.39-24.module+el8.10.0+24340+7270ac72.ppc64le.rpm SHA-256: 7a9613402e6f251ff17fa35c80f127ff47c8aba04590b803d1a45885cadb41db 389-ds-base-libs-debuginfo-1.4.3.39-24.module+el8.10.0+24340+7270ac72.ppc64le.rpm SHA-256: 463f033e059b1f351cd440ff2f7acafe8aa91dd4139c269fe39c5df3cb157a08 389-ds-base-snmp-1.4.3.39-24.module+el8.10.0+24340+7270ac72.ppc64le.rpm SHA-256: a083ca0968f60d2a35621ad57cc082d315fbf427e74fc1b0f934e49f4359c9b8 389-ds-base-snmp-debuginfo-1.4.3.39-24.module+el8.10.0+24340+7270ac72.ppc64le.rpm SHA-256: 1de5aeb2ab57b35d8f259fceaea0d2b87bb8361273cced2e4776ff796b611ccf python3-lib389-1.4.3.39-24.module+el8.10.0+24340+7270ac72.noarch.rpm SHA-256: c50442b47bb21bdc6997a5ba44862ed6946882ee8c871ff9a739883aea3f940f python3-lib389-1.4.3.39-24.module+el8.10.0+24340+7270ac72.noarch.rpm SHA-256: c50442b47bb21bdc6997a5ba44862ed6946882ee8c871ff9a739883aea3f940f python3-lib389-1.4.3.39-24.module+el8.10.0+24340+7270ac72.noarch.rpm SHA-256: c50442b47bb21bdc6997a5ba44862ed6946882ee8c871ff9a739883aea3f940f Red Hat Enterprise Linux for ARM 64 8 SRPM 389-ds-base-1.4.3.39-24.module+el8.10.0+24340+7270ac72.src.rpm SHA-256: 6cf8621de28813dc33a49649417b9c6b151476d0f01fb4c7ec802af67a9e0f39 aarch64 389-ds-base-1.4.3.39-24.module+el8.10.0+24340+7270ac72.aarch64.rpm SHA-256: 53b4cbdf7ace725a806c4b69dfd99b0ba6c610f7095dcf134381aaf8428ac0d9 389-ds-base-debuginfo-1.4.3.39-24.module+el8.10.0+24340+7270ac72.aarch64.rpm SHA-256: eef29796250f19b505493953378cec57fcea1664fda9f562ee634b0d426c787a 389-ds-base-debugsource-1.4.3.39-24.module+el8.10.0+24340+7270ac72.aarch64.rpm SHA-256: 16d23883049e5559889da49a83bb3019ae9e476aeb7f18f29ae1ec8dc2903b1d 389-ds-base-devel-1.4.3.39-24.module+el8.10.0+24340+7270ac72.aarch64.rpm SHA-256: 3fa7526e3ac34eb00b553419cb92f31ead90122b21dc0