Cpe:2.3:a:389directoryserver:389_directory_server:::::::: - CraftedSignal Threat Feed

Denial of Service in 389 Directory Server via CVE-2026-18453

hello@craftedsignal.io — Mon, 07 Sep 2026 15:33:51 +0000

CVE-2026-18453 is a vulnerability in the 389 Directory Server that allows for remote denial of service. The flaw stems from a missing NULL pointer check in the paged results handling logic within the op_shared_search function. An unauthenticated attacker can trigger this condition by sending a specially crafted sequence of LDAP search requests that utilize the USE_ONE_BACKEND control. When the server processes these requests in a specific manner, the lack of input validation results in a NULL pointer dereference, causing the LDAP server process to crash. This vulnerability is significant because it allows remote, unauthenticated actors to disrupt directory services with minimal interaction, potentially impacting authentication and authorization workflows that rely on the directory server.

Impact

Successful exploitation leads to a denial of service (DoS) of the 389 Directory Server. This impacts organizations relying on the server for centralized identity management, potentially preventing user authentication, service access, and administrative operations. The severity is assessed as high due to the ease of remote execution without authentication requirements.

Recommendation

Patch 389 Directory Server to the version containing the fix for CVE-2026-18453.
Monitor LDAP traffic for excessive or malformed search requests using the USE_ONE_BACKEND control in the request payload.
Limit network access to the LDAP service to trusted subnets and IP addresses to prevent unauthenticated remote access.

Authentication Bypass in 389 Directory Server via SASL Bind State Confusion

hello@craftedsignal.io — Mon, 07 Sep 2026 15:32:59 +0000

CVE-2026-18922 describes a critical authentication bypass vulnerability in 389 Directory Server. The issue stems from improper handling of identity state during SASL PLAIN authentication. When a bind operation fails, the server fails to properly clear the identity properties associated with the connection. A subsequent successful bind, using any SASL mechanism, allows the stale identity from the previous failed attempt to be incorrectly applied to the new security context. An attacker can deliberately trigger a failed SASL PLAIN bind as 'cn=Directory Manager' and then complete a second bind (such as an anonymous bind or a low-privileged account bind) to inherit the privileges of the identity used in the first failed attempt. This flaw grants an unauthorized attacker administrative access to the directory server without requiring valid credentials.

Impact

Successful exploitation results in full administrative control over the 389 Directory Server. An attacker can read, modify, or delete directory data, manage users, or alter security configurations, leading to a complete compromise of the identity store and downstream systems dependent on the directory for authentication or authorization.

Recommendation

Monitor 389 Directory Server access logs for unusual sequences of failed bind operations followed by immediate successful binds on the same connection.
Review directory server configuration for strict enforcement of authentication policies.
Apply patches provided by the vendor for 389 Directory Server to resolve the identity property handling flaw.

Cpe:2.3:a:389directoryserver:389_directory_server:*:*:*:*:*:*:*:* - CraftedSignal Threat Feed

Denial of Service in 389 Directory Server via CVE-2026-18453

Impact

Recommendation

Authentication Bypass in 389 Directory Server via SASL Bind State Confusion

Impact

Recommendation

Cpe:2.3:a:389directoryserver:389_directory_server:::::::: - CraftedSignal Threat Feed