CVE-2026-18453: 
Linux Red Hat Analyse et atténuation des vulnérabilités

CVE-2026-18453 is a NULL pointer dereference vulnerability in Red Hat's 389 Directory Server (389-ds-base) that allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests, resulting in denial of service. The flaw exists in the op_shared_search function's paged results handling when the USE_ONE_BACKEND control is used. Affected products include redhat-ds:11/389-ds-base, redhat-ds:12/389-ds-base, and 389-ds:1.4/389-ds-base under Red Hat Enterprise Linux. It was reported on July 31, 2026 and publicly disclosed on September 7, 2026, with a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, Github Advisory).

The root cause is a missing NULL pointer check (CWE-476) in the op_shared_search function within opshared.c. When a client sends a first LDAP SEARCH request naming a non-existent backend via the USE_ONE_BACKEND control with a Simple Paged Results (SPR) empty cookie, the server stores NULL as the backend in a paged-results slot. A subsequent SEARCH request naming a valid backend with an SPR cookie referencing that slot causes the server to retrieve the stored NULL and call slapi_be_Rlock(NULL), which dereferences the NULL pointer and crashes the ns-slapd process. This code path is reachable pre-authentication because control and paged-results processing occurs before search authorization, and both paged results and anonymous access are enabled by default (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation completely crashes the ns-slapd directory server process, halting all LDAP-based directory lookups and authentication services until the process is manually restarted. Because the attack is trivially repeatable by an unauthenticated attacker, it can result in sustained denial of service against any system or application relying on the affected 389 Directory Server instance for authentication or directory queries. There is no impact on confidentiality or integrity — the vulnerability causes a crash only and does not leak or modify directory data (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, indicating a currently low probability of exploitation in the wild, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, the attack requires no authentication, no user interaction, and low complexity, making it straightforward for any attacker with network access to the LDAP service to trigger (Red Hat CVE, Github Advisory).

1. Reconnaissance: Identify hosts running 389 Directory Server (ns-slapd) with LDAP port 389 or 636 exposed, using network scanners such as Nmap or Shodan.
2. Verify anonymous access: Confirm that anonymous LDAP access and paged results are enabled (default configuration) by sending a basic anonymous LDAP bind or search request.
3. Send first crafted SEARCH request: On a single LDAP connection, send a SEARCH request that includes the USE_ONE_BACKEND control referencing a non-existent backend name, combined with a Simple Paged Results (SPR) control with an empty cookie. This causes the server to store NULL as the backend pointer in a paged-results slot.
4. Send second crafted SEARCH request: On the same connection, send a second SEARCH request referencing a valid backend via USE_ONE_BACKEND, with an SPR cookie that references the paged-results slot populated in step 3.
5. Trigger crash: The server retrieves the NULL backend pointer from the slot and calls slapi_be_Rlock(NULL), dereferencing the NULL pointer and crashing the ns-slapd process, resulting in denial of service (Red Hat Bugzilla).

• Network: Repeated LDAP SEARCH requests on the same connection using the USE_ONE_BACKEND control (OID-based) combined with Simple Paged Results control, particularly targeting non-existent backend names followed by valid backend names.
• Logs: Sudden termination or crash entries for the ns-slapd process in /var/log/dirsrv/slapd-<instance>/errors; segmentation fault or NULL pointer dereference messages in system logs (/var/log/messages or journalctl).
• Process: Unexpected termination of the ns-slapd process; core dump files generated in the 389 Directory Server working directory or /var/lib/dirsrv/.
• Availability: Repeated, rapid restarts of the ns-slapd service correlating with incoming LDAP connections from the same source IP (Red Hat Bugzilla, Red Hat CVE).

Red Hat has not identified a practical configuration-based mitigation and recommends updating the affected 389-ds-base package as soon as a fix is released. As partial risk reduction, disabling anonymous LDAP access removes the unauthenticated exploitation path, though authenticated clients with search access can still trigger the crash. Restricting LDAP service exposure to trusted networks via firewall rules reduces the practical attack surface but does not eliminate the underlying vulnerability (Red Hat CVE).

Red Hat rated this issue as 'Important' due to the ease of unauthenticated exploitation and the complete disruption of directory services it causes. The vulnerability was reported by Arthur Chan (Ada Logics) and a team from Anthropic, reflecting growing use of AI-assisted security research in vulnerability discovery (Red Hat CVE).