VDB

CVE-2026-18663

CVE-2026-18663 PUBLISHED CVSS 5.9 MEDIUM

Reported by redhat · Published August 12, 2026

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPI_REQCONTROLS pblock slot. Operation teardown then frees the same pointer again, causing a double-free. An unauthenticated remote attacker can trigger this with a single BIND request carrying a critical Session Tracking control, resulting in heap corruption and potential denial of service.

Risk Scores

CVSS 3.1
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
Red HatRed Hat Directory Server 11
Red HatRed Hat Directory Server 12
Red HatRed Hat Directory Server 13
Red HatRed Hat Enterprise Linux 10
Red HatRed Hat Enterprise Linux 6
Red HatRed Hat Enterprise Linux 7
Red HatRed Hat Enterprise Linux 8
Red HatRed Hat Enterprise Linux 9
Red HatRed Hat Enterprise Linux 10
Red HatRed Hat Directory Server 13
Red HatRed Hat Enterprise Linux 9
Red HatRed Hat Enterprise Linux 8
Red HatRed Hat Directory Server 12
Red HatRed Hat Enterprise Linux 6
Red HatRed Hat Enterprise Linux 7
Red HatRed Hat Directory Server 11

Timeline

  • Aug 12, 2026 EPSS Score
  • Aug 12, 2026 Coalition ESS Score
  • Aug 12, 2026 CVE Published
  • Aug 14, 2026 Security Advisory
  • Aug 14, 2026 CVE Updated
  • Aug 24, 2026 EPSS Score
  • Aug 26, 2026 EPSS Score
  • Aug 30, 2026 EPSS Score
  • Sep 3, 2026 EPSS Score
  • Sep 6, 2026 EPSS Score
  • Sep 9, 2026 EPSS Score
  • Sep 12, 2026 EPSS Score

References

  • vdb-entryx_refsource_REDHAT
  • RHBZ#2510631 issue-trackingx_refsource_REDHAT
Open in Interactive Console →
$ Console Community · 100/wk Open console ›