CVE-2026-18453

EUVD-2026-72456
A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 57.59%
Debian logo
Debian Releases
Debian Product
Codename
389-ds-base
bookworm
vulnerable
sid
3.3.1-3
fixed
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
389-ds-base
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
xenial
needs-triage
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
389-ds-base
RHEL 9
0:2.8.0-10.el9_8
fixed
389-ds-base-devel
RHEL 9
0:2.8.0-10.el9_8
fixed
389-ds-base-libs
RHEL 9
0:2.8.0-10.el9_8
fixed
389-ds-base-snmp
RHEL 9
0:2.8.0-10.el9_8
fixed
python3-lib389
RHEL 9
0:2.8.0-10.el9_8
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
389-ds-base
Amazon Linux 2
0:1.3.10.2-17.amzn2.0.12
fixed
389-ds-base-debuginfo
Amazon Linux 2
0:1.3.10.2-17.amzn2.0.12
fixed
389-ds-base-devel
Amazon Linux 2
0:1.3.10.2-17.amzn2.0.12
fixed
389-ds-base-libs
Amazon Linux 2
0:1.3.10.2-17.amzn2.0.12
fixed
389-ds-base-snmp
Amazon Linux 2
0:1.3.10.2-17.amzn2.0.12
fixed