CVE-2026-18663 is a double-free vulnerability in 389-ds-base version 3.x. The flaw occurs in the get_ldapmessage_controls_ext() function where the parsed controls array is freed on the Session Tracking critical-control rejection path without clearing the SLAPI_REQCONTROLS pblock slot. This leads to a second free during operation teardown, causing heap corruption. An unauthenticated remote attacker can trigger this by sending a single BIND request with a critical Session Tracking control. The vulnerability results in denial of service due to heap corruption but does not lead to information disclosure or privilege escalation. Red Hat's builds using jemalloc absorb the double-free without crashing, limiting impact. Upstream builds using glibc are vulnerable to reliable denial of service. Mitigations include configuring the server to ignore the criticality of the Session Tracking control and restricting LDAP port access.

The vulnerability allows an unauthenticated remote attacker to cause heap corruption and potential denial of service by sending a specially crafted BIND request with a critical Session Tracking control. On Red Hat Enterprise Linux 10 and RHDS 13, which use jemalloc, the double-free does not cause a crash, limiting impact to heap corruption without service interruption. On upstream or Fedora builds using glibc, reliable denial of service is possible. There is no evidence of information disclosure or privilege escalation.

Red Hat advises adding the Session Tracking control OID (1.3.6.1.4.1.21008.108.63.1) to the ds-ignored-control-criticality configuration attribute to ignore the criticality flag and prevent the vulnerable code path. Additionally, restricting network access to LDAP ports (389/636) to trusted clients reduces exposure. No official patch is currently available; patch status is not yet confirmed — check the vendor advisory for updates.