CVE-2026-18663: 389-ds-base double-free

CISO Take

389-ds-base (Red Hat/389 Directory Server, an LDAP directory service) has a double-free bug in get_ldapmessage_controls_ext(): when a BIND request carries a critical Session Tracking control that gets rejected, the parsed controls array is freed without clearing the SLAPI_REQCONTROLS pblock slot, and operation teardown frees the same pointer again, corrupting the heap. This is a pre-authentication, network-reachable denial-of-service issue (CVSS 5.9, availability-only impact), but exploitation requires high attack complexity, sits at the 67th EPSS percentile (low near-term likelihood), has no public exploit or Nuclei template, and CISA SSVC rates it TRACK — not an urgent, actively-exploited flaw. Note this is a generic LDAP/directory-service vulnerability, not an AI/ML-specific product; it only matters to AI security teams to the extent 389-ds-base underlies identity/authentication infrastructure for AI platforms or agent tooling. Action: apply the Red Hat patch for 389-ds-base when released/available in your distro's errata, and in the interim monitor ns-slapd for unexpected crashes/restarts correlated with BIND requests carrying Session Tracking controls.

Sources:NVDEPSSCISA KEVaccess.redhat.combugzilla.redhat.com

What is the risk?

Medium severity, low near-term exploitation likelihood. The bug is pre-auth and network-reachable (AV:N, PR:N, UI:N), which raises theoretical exposure, but high attack complexity (AC:H) — the crash depends on hitting a specific control-rejection path — limits reliable weaponization. Impact is confidentiality/integrity-neutral (C:N/I:N) and availability-only (A:H), i.e., service crash/DoS, not data exposure or code execution. No CISA KEV listing, no public exploit code, and no scanner template further reduce urgency relative to actively exploited CVEs. For AI-specific risk, this CVE has essentially no direct relevance — 389-ds-base is not an AI/ML package and appears in this feed only because it may serve as an identity/auth backend in some environments.

How does the attack unfold?

Entry point

Unauthenticated attacker sends a single LDAP BIND request to a public-facing 389-ds-base instance with a critical Session Tracking control.

Trigger

The control-rejection path in get_ldapmessage_controls_ext() frees the parsed controls array without clearing the SLAPI_REQCONTROLS pblock slot.

Impact

Operation teardown frees the same pointer again, corrupting the heap and crashing the ns-slapd process, denying directory service to all dependent systems.

Entry point

Unauthenticated attacker sends a single LDAP BIND request to a public-facing 389-ds-base instance with a critical Session Tracking control.

Trigger

The control-rejection path in get_ldapmessage_controls_ext() frees the parsed controls array without clearing the SLAPI_REQCONTROLS pblock slot.

Impact

Operation teardown frees the same pointer again, corrupting the heap and crashing the ns-slapd process, denying directory service to all dependent systems.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
389-ds-base	—	—	No patch
389-ds:1.4/389-ds-base	—	—	No patch
redhat-ds:11/389-ds-base	—	—	No patch
redhat-ds:12/389-ds-base	—	—	No patch

How severe is it?

CVSS 3.1

5.9 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Patch: track the Red Hat/389-ds-base advisory (access.redhat.com/security/cve/CVE-2026-18663) and Bugzilla #2510631 for the fixed package version and apply it via your distro's package manager as soon as it's released. 2) Workaround: if patching is delayed, consider restricting/monitoring LDAP BIND traffic that includes Session Tracking controls at a network proxy or WAF layer where feasible. 3) Detection: monitor ns-slapd process stability (unexpected crashes/restarts, core dumps) and correlate with BIND request logs showing Session Tracking controls; enable core dump collection to confirm double-free signatures if crashes occur. 4) If 389-ds-base backs authentication for AI/ML tooling, ensure redundancy/HA for the directory service so a crash doesn't create a single point of failure for AI platform logins.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSAPI

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-18663?

389-ds-base (Red Hat/389 Directory Server, an LDAP directory service) has a double-free bug in get_ldapmessage_controls_ext(): when a BIND request carries a critical Session Tracking control that gets rejected, the parsed controls array is freed without clearing the SLAPI_REQCONTROLS pblock slot, and operation teardown frees the same pointer again, corrupting the heap. This is a pre-authentication, network-reachable denial-of-service issue (CVSS 5.9, availability-only impact), but exploitation requires high attack complexity, sits at the 67th EPSS percentile (low near-term likelihood), has no public exploit or Nuclei template, and CISA SSVC rates it TRACK — not an urgent, actively-exploited flaw. Note this is a generic LDAP/directory-service vulnerability, not an AI/ML-specific product; it only matters to AI security teams to the extent 389-ds-base underlies identity/authentication infrastructure for AI platforms or agent tooling. Action: apply the Red Hat patch for 389-ds-base when released/available in your distro's errata, and in the interim monitor ns-slapd for unexpected crashes/restarts correlated with BIND requests carrying Session Tracking controls.

Is CVE-2026-18663 actively exploited?

No confirmed active exploitation of CVE-2026-18663 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-18663?

1) Patch: track the Red Hat/389-ds-base advisory (access.redhat.com/security/cve/CVE-2026-18663) and Bugzilla #2510631 for the fixed package version and apply it via your distro's package manager as soon as it's released. 2) Workaround: if patching is delayed, consider restricting/monitoring LDAP BIND traffic that includes Session Tracking controls at a network proxy or WAF layer where feasible. 3) Detection: monitor ns-slapd process stability (unexpected crashes/restarts, core dumps) and correlate with BIND request logs showing Session Tracking controls; enable core dump collection to confirm double-free signatures if crashes occur. 4) If 389-ds-base backs authentication for AI/ML tooling, ensure redundancy/HA for the directory service so a crash doesn't create a single point of failure for AI platform logins.

What systems are affected by CVE-2026-18663?

This vulnerability affects the following AI/ML architecture patterns: Identity/directory backends supporting authentication for AI platforms or agent tooling (indirect; 389-ds-base itself is not an AI/ML component).

What is the CVSS score for CVE-2026-18663?

CVE-2026-18663 has a CVSS v3.1 base score of 5.9 (MEDIUM). The EPSS exploitation probability is 0.51%.

What is the AI security impact?

Affected AI Architectures

Identity/directory backends supporting authentication for AI platforms or agent tooling (indirect; 389-ds-base itself is not an AI/ML component)

What are the technical details?

Original Advisory

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPI_REQCONTROLS pblock slot. Operation teardown then frees the same pointer again, causing a double-free. An unauthenticated remote attacker can trigger this with a single BIND request carrying a critical Session Tracking control, resulting in heap corruption and potential denial of service.

Exploitation Scenario

An unauthenticated attacker with network access to the LDAP service sends a single BIND request that includes a Session Tracking control marked critical. The server's control-parsing rejection path frees the parsed controls array but fails to clear the corresponding pblock slot; when the operation is torn down, the same memory is freed a second time, corrupting the heap and crashing the ns-slapd process. Repeated requests could be used to reliably take the directory service offline, disrupting any downstream system — including AI tooling or agent platforms — that depends on it for authentication.

Weaknesses (CWE)

CWE-415Double Free

CWE-415 — Double Free: The product calls free() twice on the same memory address.

[Architecture and Design] Choose a language that provides automatic memory management.
[Implementation] Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.

Source: MITRE CWE corpus.