CVE-2026-18453

389 Directory Server contains a NULL pointer dereference flaw (CWE-476) in the paged-results handling of the op_shared_search function, where a missing NULL check can be hit while processing search operations that carry the USE_ONE_BACKEND control. An unauthenticated remote attacker with network access to the LDAP service can send a crafted sequence of such search requests to drive the server into the faulty code path and crash it. The result is a denial of service: the directory process (ns-slapd) terminates, interrupting LDAP lookups, authentication, and dependent identity services until the service is restarted, with no confidentiality or integrity impact (CVSS 3.1 score 7.5). Any deployment of the affected 389 Directory Server code is in scope, including 389-ds-base distributed by Red Hat (the assigning CNA) with Red Hat Enterprise Linux/Fedora and its role as the directory backend in Red Hat Identity Management/FreeIPA; the source data does not specify exact vulnerable version ranges, so treat currently maintained releases as at-risk pending vendor advisories. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS is 0.8% (percentile 56), so no in-the-wild exploitation has been reported.

What to do: Apply the patched 389-ds-base package from Red Hat/Fedora security advisories as soon as it is available for your release, checking the installed version with 'rpm -q 389-ds-base' on RHEL systems. Until patched, restrict unauthenticated access to LDAP ports 389/636 with firewall or access-control rules, and monitor directory server logs for repeated ns-slapd crashes following bursts of paged search requests.