Red Hat Security Advisory: Red Hat Directory Server 13.2 container image update
🔗 CVE IDs covered (1)
📋 Description
CVE-2026-9064 — 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS)
🎯 Affected products2
- Red Hat Directory Server 13.2
- registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:51f5e2a7accfc7a5346d3915c1e6574438bf788926030c43d92483b41ff4c467_amd64 as a component of Red Hat Directory Server 13.2
✅ Remediation
The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. For more information about the image, search the <image_name> in the Red Hat Ecosystem Catalog: https://catalog.redhat.com/software/containers/search Workaround: Restrict network access to the LDAP port (389/tcp, 636/tcp) to trusted networks only using firewall rules or network ACLs. This prevents untrusted remote attackers from reaching the vulnerable code path. Optionally, lower the nsslapd-maxbersize configuration parameter to reduce the maximum BER message size accepted by the server. Note that this caps bytes, not the number of controls, and does not fully eliminate the amplification. Setting it too low may impact legitimate LDAP operations with large payloads.
🔗 References (6)
- selfhttps://access.redhat.com/errata/RHSA-2026:27125
- externalhttps://access.redhat.com/security/cve/CVE-2026-9064
- externalhttps://access.redhat.com/security/updates/classification/
- externalhttps://catalog.redhat.com/software/containers/search
- externalhttps://docs.redhat.com/en/documentation/red_hat_directory_server/13/html/red_hat_directory_server_13_release_notes/index
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27125.json