CVE-2026-9064

redhat directory server, redhat 389 directory server, redhat enterprise linux

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-9064

Katalog CVE

CVSS 7.5 · High EPSS 1,1%

Kerentanan Allocation of Resources Without Limits or Throttling pada redhat directory server, redhat 389 directory server +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.

Rincian

Terbit di NVD
20 Mei 2026
Terakhir diubah
21 Agustus 2026
Status NVD
Modified
CVSS 3.1
7.5 (High), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-770: Allocation of Resources Without Limits or Throttling
EPSS (30 hari)
1,1% peluang dieksploitasi; lebih tinggi dari 64,2% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
redhat directory server Versi 11.0
redhat directory server Versi 12.0
redhat directory server Versi 13.0
redhat 389 directory server Semua versi
redhat enterprise linux Versi 6.0
redhat enterprise linux Versi 7.0
redhat enterprise linux Versi 8.0
redhat enterprise linux Versi 9.0
redhat enterprise linux Versi 10.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.