The vulnerability in 389-ds-base arises from the get_ldapmessage_controls_ext() function not enforcing an upper bound on the number of LDAP controls per message. An attacker can exploit this by sending LDAP requests containing hundreds of thousands of minimal controls within the allowed BER message size (2 MB). This results in excessive CPU usage and heap allocation on the server, causing significant performance degradation or denial of service. The issue affects Red Hat Directory Server 11.5 E4S for RHEL 8 and related Red Hat Enterprise Linux 7 and 9 Extended Lifecycle Support versions. Red Hat has issued security advisories RHSA-2026:26452 and RHSA-2026:26453 with patches that fix this vulnerability by bounding the LDAP controls count.

A remote, unauthenticated attacker can cause a denial of service on affected Red Hat Directory Server instances by sending specially crafted LDAP requests with an unbounded number of controls. This leads to excessive CPU consumption and heap memory allocation, resulting in latency degradation, worker thread starvation, or out-of-memory termination of the LDAP server process. The vulnerability does not impact confidentiality or integrity but causes availability disruption.

Red Hat has released official security updates for 389-ds-base that address this vulnerability by enforcing limits on LDAP controls count. Users should apply the updated packages as per Red Hat advisories RHSA-2026:26452 and RHSA-2026:26453. The advisories provide detailed instructions and updated package versions for Red Hat Enterprise Linux 7 Extended Lifecycle Support, 8, and 9. No additional mitigation is required beyond applying these official patches.