A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.

oracle_linux ELSA-2026-26459: ELSA-2026-26459:  389-ds:1.4 security update (IMPORTANT)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:26459 advisory.

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6d00814a85 advisory.

    Resolves: CVE-2026-9064

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26456 advisory.

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

    Bug Fix(es) and Enhancement(s):

    * DS 12 does not handle escape char in bind user [rhel-10.2.z] (JIRA:Rocky Linux-170271)

    * dnaSharedConfig: dnaPortNum: 0 [rhel-10.2.z] (JIRA:Rocky Linux-170276)

    * Memory leaks in syncrepl plugin during persistent search operations [rhel-10.2.z] (JIRA:Rocky     Linux-170281)

    * access log - suspicious wtime  optime negative and large values in internal op [rhel-10.2.z] (JIRA:Rocky     Linux-170363)

    * An online reinitialization with LMDB is terminating the receiving server [rhel-10.2.z] (JIRA:Rocky     Linux-170478)

    * dsctl healthcheck DSMOLE0001 inaccurate recommendations when there is more than 1 LDAP backend     [rhel-10.2.z] (JIRA:Rocky Linux-170481)

    * Possible memory leak when using the Retro Changelog plugin. [rhel-10.2.z] (JIRA:Rocky Linux-170515)

    * [RFE] Add OS-level thread names to all server threads [rhel-10.2.z] (JIRA:Rocky Linux-174526)

    * Online export is failing when using the option -s [rhel-10.2.z] (JIRA:Rocky Linux-180718)

    * Server shutdown during online reindex may lead to data loss [rhel-10.2.z] (JIRA:Rocky Linux-183897)

    * Error: NssSsl.add_cert() got an unexpected keyword argument 'input_file' [rhel-10.2.z] (JIRA:Rocky     Linux-183898)

    * Replication errors in logs [rhel-10.2.z] (JIRA:Rocky Linux-183899)

    * Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths     are configured [rhel-10.2.z] (JIRA:Rocky Linux-183900)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2417-1 advisory.

    This update for 389-ds fixes the following issue

    Update to 2.2.10~git229.1fa7ffdb4:

    - CVE-2026-9064: unbounded LDAP controls count in `get_ldapmessage_controls_ext()` can lead to amplified     CPU time and       heap allocation and a denial of service (bsc#1265898).

    Changelog:

     * Issue 7503 - CVE-2026-9064 - Add a limit to the number controls per operation
     * Issue 7457 - Refactor memberOf perf test (#7458)
     * Issue 7431 - password policy - passwordBadWords is ignored in local policies
     * Issue 7417 - UI - global password policy syntax settings missing passwordMaxRepeats
     * Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7411)
     * Issue 7088 - Change log level for 'Can't locate CSN' error message
     * Issue 7423 - cleanup pblock after freeing pre/post entries
     * Issue 7418 - Use-after-free in deferred memberof (#7419)
     * Issue 7277 - UI - Fix Japanese translation errors errors in Cockpit UI (#7386)
     * Issue 7126 - WARN - keys2idl - received NULL idl from index_read_ext_allids (#7127)
     * Issue 7370 - Runtime LSan/TSan injection for pytest (#7371)
     * Issue 7378 - Make sure suffix entry always gets assigned ID 1
     * Issue 7380 - Internal op with negative wtime and large optime (#7381)
     * Issue 7362 - UI - Some FormSelect onChange parameters are reversed
     * Issue 7368 - UI - global password policy page is missing passwordmintokenlength
     * Issue 7366 - Memory leaks in syncrepl plugin during persistent search operations (#7367)
     * Issue 7284 - CI - Fix test_grace_limit_section after pwpolicy validation fix (#7357)
     * Issue 3555 - UI - Fix audit issue with npm - flatted, picomatch (#7364)
     * Issue 1704 - DNA plugin creates invalid shared config entry with port 0 (#7352)
     * Issue 6753 - Removing ticket 477828 test and porting to DSLdapObject (#6989)
     * Issue 7342 - CI - repl config regression (#7343)
     * Issue 7319 - Action menu for certificates remains in empty certificate list (#7320)
     * Issue 6868 - UI - schema attribute table expansion break after moving to a new page
     * Issue 7093 - A password policy can be created even when an identical policy already exists (#7283)
     * Issue 7233 - test_produce_division_by_zero fails with IsADirectoryError in conftest.py (#7234)
     * Issue 7152 - ns-slapd fails to shutdown when deferred memberof update is in progress (#7187)
     * Issue 3555 - UI - Fix audit issue with npm - ajv, minimatch (#7298)
     * Issue 7291 - Crash when configuring a replica with an incorrect nsds5ReplicaRoot (#7292)
     * Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7285)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26459 advisory.

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2418-1 advisory.

    This update for 389-ds fixes the following issue

    Update to 2.2.10~git229.1fa7ffdb4:

    - CVE-2026-9064: unbounded LDAP controls count in `get_ldapmessage_controls_ext()` can lead to amplified     CPU time and       heap allocation and a denial of service (bsc#1265898).

    Changelog:

     * Issue 7503 - CVE-2026-9064 - Add a limit to the number controls per operation
     * Issue 7457 - Refactor memberOf perf test (#7458)
     * Issue 7431 - password policy - passwordBadWords is ignored in local policies
     * Issue 7417 - UI - global password policy syntax settings missing passwordMaxRepeats
     * Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7411)
     * Issue 7088 - Change log level for 'Can't locate CSN' error message
     * Issue 7423 - cleanup pblock after freeing pre/post entries
     * Issue 7418 - Use-after-free in deferred memberof (#7419)
     * Issue 7277 - UI - Fix Japanese translation errors errors in Cockpit UI (#7386)
     * Issue 7126 - WARN - keys2idl - received NULL idl from index_read_ext_allids (#7127)
     * Issue 7370 - Runtime LSan/TSan injection for pytest (#7371)
     * Issue 7378 - Make sure suffix entry always gets assigned ID 1
     * Issue 7380 - Internal op with negative wtime and large optime (#7381)
     * Issue 7362 - UI - Some FormSelect onChange parameters are reversed
     * Issue 7368 - UI - global password policy page is missing passwordmintokenlength
     * Issue 7366 - Memory leaks in syncrepl plugin during persistent search operations (#7367)
     * Issue 7284 - CI - Fix test_grace_limit_section after pwpolicy validation fix (#7357)
     * Issue 3555 - UI - Fix audit issue with npm - flatted, picomatch (#7364)
     * Issue 1704 - DNA plugin creates invalid shared config entry with port 0 (#7352)
     * Issue 6753 - Removing ticket 477828 test and porting to DSLdapObject (#6989)
     * Issue 7342 - CI - repl config regression (#7343)
     * Issue 7319 - Action menu for certificates remains in empty certificate list (#7320)
     * Issue 6868 - UI - schema attribute table expansion break after moving to a new page
     * Issue 7093 - A password policy can be created even when an identical policy already exists (#7283)
     * Issue 7233 - test_produce_division_by_zero fails with IsADirectoryError in conftest.py (#7234)
     * Issue 7152 - ns-slapd fails to shutdown when deferred memberof update is in progress (#7187)
     * Issue 3555 - UI - Fix audit issue with npm - ajv, minimatch (#7298)
     * Issue 7291 - Crash when configuring a replica with an incorrect nsds5ReplicaRoot (#7292)
     * Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7285)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2419-1 advisory.

    This update for 389-ds fixes the following issue

    Update to 2.7.0~git193.9ab79d496:

    - CVE-2026-9064: unbounded LDAP controls count in `get_ldapmessage_controls_ext()` can lead to amplified     CPU time and       heap allocation and a denial of service (bsc#1265898).

    Changelog:

     * Issue 7503 - CVE-2026-9064 - Add a limit to the number controls per operation
     * Issue 7300 - RFE - Add OS-level thread names to all server threads (#7301)
     * Issue 7307 - RFE - Expose work queue and worker utilization metrics (#7308)
     * Issue 7464 - CLI - allow dsidm to work with other user types
     * Issue 7457 - Refactor memberOf perf test (#7458)
     * Issue 7452 - UI - password polices - reorganize settings
     * Issue 7431 - password policy - passwordBadWords is ignored in local policies
     * Issue 7155 - build_candidate_list - Database error 11 with range search (#7156)
     * Issue 7417 - UI - global password policy syntax settings missing passwordMaxRepeats
     * Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7411)
     * Issue 7088 - Change log level for 'Can't locate CSN' error message
     * Issue 7423 - cleanup pblock after freeing pre/post entries
     * Issue 7418 - Use-after-free in deferred memberof (#7419)
     * Issue 7407 - dbscan -k option display entries that do not match the specified key
     * Issue 7394 - UI - Manual typing of ports can leave out digits (#7395)
     * Issue 7277 - UI - Fix Japanese translation errors errors in Cockpit UI (#7386)
     * Issue 7126 - WARN - keys2idl - received NULL idl from index_read_ext_allids (#7127)
     * Issue 7370 - Runtime LSan/TSan injection for pytest (#7371)
     * Issue 7378 - Make sure suffix entry always gets assigned ID 1
     * Issue 7380 - Internal op with negative wtime and large optime (#7381)
     * Issue 7362 - UI - Some FormSelect onChange parameters are reversed
     * Issue 7368 - UI - global password policy page is missing passwordmintokenlength
     * Issue 7366 - Memory leaks in syncrepl plugin during persistent search operations (#7367)
     * Issue 7284 - CI - Fix test_grace_limit_section after pwpolicy validation fix (#7357)
     * Issue 7271 - Add test for retrocl trimming shutdown crash (#7356)
     * Issue 3555 - UI - Fix audit issue with npm - flatted, picomatch (#7364)
     * Issue 1704 - DNA plugin creates invalid shared config entry with port 0 (#7352)
     * Issue 6753 - Removing ticket 477828 test and porting to DSLdapObject (#6989)
     * Issue 7346 - DS does not handle escape char in bind user (#7347)
     * Issue 7322 - Fix cherry-pick error (reject repl agmt that points to itself)
     * Issue 7322 - Reject adding a replication agreement that points to itself
     * Issue 7342 - CI - repl config regression (#7343)
     * Issue - UI - Improve suffix import LDIF table
     * Issue 7325 - UI - new error parser missing import
     * Issue 7325 - UI - create an error parser for cockpit spawn errors
     * Issue 7319 - Action menu for certificates remains in empty certificate list (#7320)
     * Issue 7265 - CI - fix retro changelog maxage validation test
     * Issue 7093 - A password policy can be created even when an identical policy already exists (#7283)
     * Issue 7233 - test_produce_division_by_zero fails with IsADirectoryError in conftest.py (#7234)
     * Issue 7271 - Add new plugin pre-close function check to plugin_invoke_plugin_pb
     * Issue 7304 - retrocl should not cache DN
     * Issue 7265 - Add dse modify callback to validate retrocl trimming settings
     * Issue 7152 - ns-slapd fails to shutdown when deferred memberof update is in progress (#7187)
     * Issue 3555 - UI - Fix audit issue with npm - ajv, minimatch (#7298)
     * Issue 7271 - implement a pre-close plugin function
     * Issue 7291 - Crash when configuring a replica with an incorrect nsds5ReplicaRoot (#7292)
     * Issue 7295 - changelog max age validation cherry-pick error
     * Issue 7265 - changelog maxage validation is not strict enough
     * Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7285)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26599 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26597 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26455 advisory.

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

    Bug Fix(es) and Enhancement(s):

    * Getting build_candidate_list - Database error 11 messages after migrating to LMDB. [rhel-9.8.z]     (JIRA:Rocky Linux-152356)

    * Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. [rhel-9.8.z] (JIRA:Rocky     Linux-168967)

    * DS 12 does not handle escape char in bind user [rhel-9.8.z] (JIRA:Rocky Linux-170269)

    * [RFE] Add OS-level thread names to all server threads [rhel-9.8.z] (JIRA:Rocky Linux-174524)

    * Online export is failing when using the option -s [rhel-9.8.z] (JIRA:Rocky Linux-180716)

    * Server shutdown during online reindex may lead to data loss [rhel-9.8.z] (JIRA:Rocky Linux-183895)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26639 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26456 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

    Bug Fix(es) and Enhancement(s):

    * DS 12 does not handle escape char in bind user [rhel-10.2.z] (JIRA:RHEL-170271)

    * dnaSharedConfig: dnaPortNum: 0 [rhel-10.2.z] (JIRA:RHEL-170276)

    * Memory leaks in syncrepl plugin during persistent search operations [rhel-10.2.z] (JIRA:RHEL-170281)

    * access log - suspicious wtime  optime negative and large values in internal op [rhel-10.2.z]     (JIRA:RHEL-170363)

    * An online reinitialization with LMDB is terminating the receiving server [rhel-10.2.z]     (JIRA:RHEL-170478)

    * dsctl healthcheck DSMOLE0001 inaccurate recommendations when there is more than 1 LDAP backend     [rhel-10.2.z] (JIRA:RHEL-170481)

    * Possible memory leak when using the Retro Changelog plugin. [rhel-10.2.z] (JIRA:RHEL-170515)

    * [RFE] Add OS-level thread names to all server threads [rhel-10.2.z] (JIRA:RHEL-174526)

    * Online export is failing when using the option -s [rhel-10.2.z] (JIRA:RHEL-180718)

    * Server shutdown during online reindex may lead to data loss [rhel-10.2.z] (JIRA:RHEL-183897)

    * Error: NssSsl.add_cert() got an unexpected keyword argument 'input_file' [rhel-10.2.z]     (JIRA:RHEL-183898)

    * Replication errors in logs [rhel-10.2.z] (JIRA:RHEL-183899)

    * Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths     are configured [rhel-10.2.z] (JIRA:RHEL-183900)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26457 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26461 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26465 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26455 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

    Bug Fix(es) and Enhancement(s):

    * Getting build_candidate_list - Database error 11 messages after migrating to LMDB. [rhel-9.8.z]     (JIRA:RHEL-152356)

    * Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. [rhel-9.8.z]     (JIRA:RHEL-168967)

    * DS 12 does not handle escape char in bind user [rhel-9.8.z] (JIRA:RHEL-170269)

    * [RFE] Add OS-level thread names to all server threads [rhel-9.8.z] (JIRA:RHEL-174524)

    * Online export is failing when using the option -s [rhel-9.8.z] (JIRA:RHEL-180716)

    * Server shutdown during online reindex may lead to data loss [rhel-9.8.z] (JIRA:RHEL-183895)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26459 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26454 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26453 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26452 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26464 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26460 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26463 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and     heap amplification (remote DoS) (CVE-2026-9064)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26458 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Directory Server 11.9 for RHEL 8     Release Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2316-1 advisory.

    This update for 389-ds fixes the following issue

    - CVE-2026-9064: unbounded LDAP controls count in `get_ldapmessage_controls_ext()` can lead to amplified     CPU time and       heap allocation and a denial of service (bsc#1265898).

    Changes for 389-ds:

    - Update to version 2.0.20~git90.9f70d434e.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3339 advisory.

    A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not     enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can     send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the     default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the     server. Under concurrent exploitation, this leads to significant latency degradation, worker thread     starvation, or out-of-memory termination, resulting in a denial of service. (CVE-2026-9064)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not     enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can     send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the     default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the     server. Under concurrent exploitation, this leads to significant latency degradation, worker thread     starvation, or out-of-memory termination, resulting in a denial of service. (CVE-2026-9064)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321930	AlmaLinux 8 : 389-ds:1.4 (ALSA-2026:26459)	Nessus	Alma Linux Local Security Checks	high
321859	Fedora 44 : 389-ds-base (2026-6d00814a85)	Nessus	Fedora Local Security Checks	high
321757	RockyLinux 10 : 389-ds-base (RLSA-2026:26456)	Nessus	Rocky Linux Local Security Checks	high
321639	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2026:2417-1)	Nessus	SuSE Local Security Checks	high
321628	RockyLinux 8 : 389-ds:1.4 (RLSA-2026:26459)	Nessus	Rocky Linux Local Security Checks	high
321599	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2026:2418-1)	Nessus	SuSE Local Security Checks	high
321584	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2026:2419-1)	Nessus	SuSE Local Security Checks	high
321566	RHEL 9 : redhat-ds:12 (RHSA-2026:26599)	Nessus	Red Hat Local Security Checks	high
321565	RHEL 8 : redhat-ds:11 (RHSA-2026:26597)	Nessus	Red Hat Local Security Checks	high
321498	RockyLinux 9 : 389-ds-base (RLSA-2026:26455)	Nessus	Rocky Linux Local Security Checks	high
321493	RHEL 9 : redhat-ds:12 (RHSA-2026:26639)	Nessus	Red Hat Local Security Checks	high
321332	RHEL 10 : 389-ds-base (RHSA-2026:26456)	Nessus	Red Hat Local Security Checks	high
321331	RHEL 10 : 389-ds-base (RHSA-2026:26457)	Nessus	Red Hat Local Security Checks	high
321329	RHEL 8 : redhat-ds:11 (RHSA-2026:26461)	Nessus	Red Hat Local Security Checks	high
321328	RHEL 9 : 389-ds-base (RHSA-2026:26465)	Nessus	Red Hat Local Security Checks	high
321326	RHEL 9 : 389-ds-base (RHSA-2026:26455)	Nessus	Red Hat Local Security Checks	high
321325	RHEL 8 : 389-ds:1.4 (RHSA-2026:26459)	Nessus	Red Hat Local Security Checks	high
321324	RHEL 8 : 389-ds:1.4 (RHSA-2026:26454)	Nessus	Red Hat Local Security Checks	high
321323	RHEL 7 : 389-ds-base (RHSA-2026:26453)	Nessus	Red Hat Local Security Checks	high
321322	RHEL 9 : 389-ds-base (RHSA-2026:26452)	Nessus	Red Hat Local Security Checks	high
321320	RHEL 9 : 389-ds-base (RHSA-2026:26464)	Nessus	Red Hat Local Security Checks	high
321319	RHEL 8 : 389-ds:1.4 (RHSA-2026:26460)	Nessus	Red Hat Local Security Checks	high
321318	RHEL 8 : 389-ds:1.4 (RHSA-2026:26463)	Nessus	Red Hat Local Security Checks	high
321317	RHEL 8 : redhat-ds:11 (RHSA-2026:26458)	Nessus	Red Hat Local Security Checks	high
321029	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2026:2316-1)	Nessus	SuSE Local Security Checks	high
319836	Amazon Linux 2 : 389-ds-base, --advisory ALAS2-2026-3339 (ALAS-2026-3339)	Nessus	Amazon Linux Local Security Checks	high
315777	Linux Distros Unpatched Vulnerability : CVE-2026-9064	Nessus	Misc.	high

Detections

Analytics

CVE-2026-9064

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high