Description

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-07T15:17:31.017Z",
  "pubdate": "2026-09-07T15:17:31.017Z",
  "executiveSummary": "This vulnerability involves a NULL pointer dereference flaw within the 389 Directory Server, specifically identified in the paged results handling logic of the op_shared_search function.\nThe vulnerability allows an unauthenticated, remote attacker to trigger a denial of service (DoS) condition by inducing a server crash.\nBy submitting a specially crafted sequence of LDAP search requests incorporating the USE_ONE_BACKEND control, an attacker can exploit the missing NULL pointer validation to cause an abnormal termination of the directory server process.\nThe impact is significant, as it results in a service outage, disrupting identity and authentication services that rely on the 389 Directory Server.\nExploitation does not require prior authentication or elevated privileges, making the service accessible to any network-capable attacker with connectivity to the LDAP port.\nThe risk implication is high for organizations where 389 Directory Server serves as a centralized identity repository, as the crash leads to a complete loss of availability for directory-dependent applications.",
  "technicalDetails": "The vulnerability resides within the op_shared_search function in the 389 Directory Server codebase, which is responsible for coordinating LDAP search operations. The root cause is a failure to perform adequate input validation or NULL pointer checking when processing paged results in conjunction with specific LDAP controls.\nSpecifically, when the server processes a search request containing the USE_ONE_BACKEND control, the internal state machine responsible for managing paged results reaches a code path that attempts to access a pointer variable before verifying if it has been correctly initialized or populated. In scenarios where the LDAP request sequence is crafted to bypass standard object allocation for the paged result set, the pointer remains NULL.\nThe attack flow proceeds as follows: First, the remote attacker initiates a connection to the 389 Directory Server over the LDAP protocol. Second, the attacker transmits a sequence of LDAP search requests that utilize the USE_ONE_BACKEND control. This control forces the directory server to execute the search logic through a specific backend invocation path. Third, due to the missing NULL pointer check in op_shared_search, the application attempts to perform a dereference operation on the uninitialized pointer while attempting to retrieve session or result set data. Finally, this memory access violation triggers a segmentation fault (SIGSEGV) within the slapd process, resulting in an immediate crash and subsequent denial of service.\nBecause the server is designed to process these requests from any network-connected client, the vulnerability is fully exploitable without requiring authentication, providing the attacker with a high-impact, low-complexity denial-of-service vector. The payload behavior is strictly confined to the process space of the directory server, inducing a memory corruption state that the process cannot recover from autonomously. Since the flaw is tied to the internal logic of how the USE_ONE_BACKEND control interacts with paged search state, it does not allow for arbitrary code execution, but it effectively invalidates the reliability of the directory service until the service is manually restarted or recovered by a supervisor process."
}