A double-free vulnerability exists in the get_ldapmessage_controls_ext() function of 389-ds-base, part of Red Hat Directory Server 11. The function frees a parsed controls array on the Session Tracking critical-control rejection path without clearing the associated SLAPI_REQCONTROLS pblock slot, causing a second free during operation teardown. An unauthenticated remote attacker can trigger this via a single BIND request with a critical Session Tracking control, resulting in heap corruption and potential denial of service. Red Hat rates this as moderate severity due to the requirement of a critical Session Tracking control in the request and because RHEL 10 and RHDS 13 builds using jemalloc do not crash. The vulnerability affects only 389-ds-base 3.x versions that include the Session Tracking control feature. Mitigation includes configuring the server to ignore the criticality flag of this control or restricting LDAP port access. No evidence of information disclosure or privilege escalation is reported.

The vulnerability can cause heap corruption leading to denial of service by crashing the ns-slapd process when exploited on builds using the glibc allocator. Builds using jemalloc (such as RHEL 10 and RHDS 13) absorb the double-free without crashing, limiting impact. There is no demonstrated information disclosure or privilege escalation. Exploitation requires sending an unauthenticated BIND request with a critical Session Tracking control. The impact is therefore limited to availability disruption on certain builds.

Red Hat has not indicated an official patch release yet; patch status is not confirmed—check the vendor advisory for updates. Administrators can mitigate the issue by adding the Session Tracking control OID (1.3.6.1.4.1.21008.108.63.1) to the ds-ignored-control-criticality configuration attribute to ignore the criticality flag and prevent the vulnerable code path. Additionally, restricting network access to LDAP ports (389/636) to trusted clients reduces exposure. These mitigations reduce the risk until an official fix is available.