Vulnerability-Lookup

SUSE-SU-2026:2418-1

Vulnerability from csaf_suse - Published: 2026-06-16 13:29 - Updated: 2026-06-16 13:29

Summary

Security update for 389-ds

Severity

Important

Notes

Title of the patch: Security update for 389-ds

Description of the patch: This update for 389-ds fixes the following issue Update to 2.2.10~git229.1fa7ffdb4: - CVE-2026-9064: unbounded LDAP controls count in `get_ldapmessage_controls_ext()` can lead to amplified CPU time and heap allocation and a denial of service (bsc#1265898). Changelog: * Issue 7503 - CVE-2026-9064 - Add a limit to the number controls per operation * Issue 7457 - Refactor memberOf perf test (#7458) * Issue 7431 - password policy - passwordBadWords is ignored in local policies * Issue 7417 - UI - global password policy syntax settings missing passwordMaxRepeats * Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7411) * Issue 7088 - Change log level for 'Can't locate CSN' error message * Issue 7423 - cleanup pblock after freeing pre/post entries * Issue 7418 - Use-after-free in deferred memberof (#7419) * Issue 7277 - UI - Fix Japanese translation errors errors in Cockpit UI (#7386) * Issue 7126 - WARN - keys2idl - received NULL idl from index_read_ext_allids (#7127) * Issue 7370 - Runtime LSan/TSan injection for pytest (#7371) * Issue 7378 - Make sure suffix entry always gets assigned ID 1 * Issue 7380 - Internal op with negative wtime and large optime (#7381) * Issue 7362 - UI - Some FormSelect onChange parameters are reversed * Issue 7368 - UI - global password policy page is missing passwordmintokenlength * Issue 7366 - Memory leaks in syncrepl plugin during persistent search operations (#7367) * Issue 7284 - CI - Fix test_grace_limit_section after pwpolicy validation fix (#7357) * Issue 3555 - UI - Fix audit issue with npm - flatted, picomatch (#7364) * Issue 1704 - DNA plugin creates invalid shared config entry with port 0 (#7352) * Issue 6753 - Removing ticket 477828 test and porting to DSLdapObject (#6989) * Issue 7342 - CI - repl config regression (#7343) * Issue 7319 - Action menu for certificates remains in empty certificate list (#7320) * Issue 6868 - UI - schema attribute table expansion break after moving to a new page * Issue 7093 - A password policy can be created even when an identical policy already exists (#7283) * Issue 7233 - test_produce_division_by_zero fails with IsADirectoryError in conftest.py (#7234) * Issue 7152 - ns-slapd fails to shutdown when deferred memberof update is in progress (#7187) * Issue 3555 - UI - Fix audit issue with npm - ajv, minimatch (#7298) * Issue 7291 - Crash when configuring a replica with an incorrect nsds5ReplicaRoot (#7292) * Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7285)

Patchnames: SUSE-2026-2418,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-2418,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-2418

CVE-2026-9064

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 40 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64	—	Vendor Fix

Threats

Impact important

References

8 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1265898	self
https://www.suse.com/security/cve/CVE-2026-9064/	self
https://www.suse.com/security/cve/CVE-2026-9064	external
https://bugzilla.suse.com/1265898	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for 389-ds",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for 389-ds fixes the following issue\n\nUpdate to 2.2.10~git229.1fa7ffdb4:\n\n- CVE-2026-9064: unbounded LDAP controls count in `get_ldapmessage_controls_ext()` can lead to amplified CPU time and\n  heap allocation and a denial of service (bsc#1265898).\n\nChangelog:\n\n * Issue 7503 - CVE-2026-9064 - Add a limit to the number controls per operation\n * Issue 7457 - Refactor memberOf perf test (#7458)\n * Issue 7431 - password policy - passwordBadWords is ignored in local policies\n * Issue 7417 - UI - global password policy syntax settings missing passwordMaxRepeats\n * Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7411)\n * Issue 7088 - Change log level for \u0027Can\u0027t locate CSN\u0027 error message\n * Issue 7423 - cleanup pblock after freeing pre/post entries\n * Issue 7418 - Use-after-free in deferred memberof (#7419)\n * Issue 7277 - UI - Fix Japanese translation errors errors in Cockpit UI (#7386)\n * Issue 7126 - WARN - keys2idl - received NULL idl from index_read_ext_allids (#7127)\n * Issue 7370 - Runtime LSan/TSan injection for pytest (#7371)\n * Issue 7378 - Make sure suffix entry always gets assigned ID 1\n * Issue 7380 - Internal op with negative wtime and large optime (#7381)\n * Issue 7362 - UI - Some FormSelect onChange parameters are reversed\n * Issue 7368 - UI - global password policy page is missing passwordmintokenlength\n * Issue 7366 - Memory leaks in syncrepl plugin during persistent search operations (#7367)\n * Issue 7284 - CI - Fix test_grace_limit_section after pwpolicy validation fix (#7357)\n * Issue 3555 - UI - Fix audit issue with npm - flatted, picomatch (#7364)\n * Issue 1704 - DNA plugin creates invalid shared config entry with port 0 (#7352)\n * Issue 6753 - Removing ticket 477828 test and porting to DSLdapObject (#6989)\n * Issue 7342 - CI - repl config regression (#7343)\n * Issue 7319 - Action menu for certificates remains in empty certificate list (#7320)\n * Issue 6868 - UI - schema attribute table expansion break after moving to a new page\n * Issue 7093 - A password policy can be created even when an identical policy already exists (#7283)\n * Issue 7233 - test_produce_division_by_zero fails with IsADirectoryError in conftest.py (#7234)\n * Issue 7152 - ns-slapd fails to shutdown when deferred memberof update is in progress (#7187)\n * Issue 3555 - UI - Fix audit issue with npm - ajv, minimatch (#7298)\n * Issue 7291 - Crash when configuring a replica with an incorrect nsds5ReplicaRoot (#7292)\n * Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7285)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-2418,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-2418,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-2418",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_2418-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:2418-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20262418-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:2418-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-June/026799.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1265898",
        "url": "https://bugzilla.suse.com/1265898"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-9064 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-9064/"
      }
    ],
    "title": "Security update for 389-ds",
    "tracking": {
      "current_release_date": "2026-06-16T13:29:41Z",
      "generator": {
        "date": "2026-06-16T13:29:41Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:2418-1",
      "initial_release_date": "2026-06-16T13:29:41Z",
      "revision_history": [
        {
          "date": "2026-06-16T13:29:41Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
                "product": {
                  "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
                  "product_id": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
                "product": {
                  "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
                  "product_id": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "389-ds-snmp-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
                "product": {
                  "name": "389-ds-snmp-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
                  "product_id": "389-ds-snmp-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
                "product": {
                  "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
                  "product_id": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
                "product": {
                  "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
                  "product_id": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
                "product": {
                  "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
                  "product_id": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
                "product": {
                  "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
                  "product_id": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "389-ds-snmp-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
                "product": {
                  "name": "389-ds-snmp-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
                  "product_id": "389-ds-snmp-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
                "product": {
                  "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
                  "product_id": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
                "product": {
                  "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
                  "product_id": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
                "product": {
                  "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
                  "product_id": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
                "product": {
                  "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
                  "product_id": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "389-ds-snmp-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
                "product": {
                  "name": "389-ds-snmp-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
                  "product_id": "389-ds-snmp-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
                "product": {
                  "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
                  "product_id": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
                "product": {
                  "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
                  "product_id": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
                "product": {
                  "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
                  "product_id": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
                "product": {
                  "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
                  "product_id": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "389-ds-snmp-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
                "product": {
                  "name": "389-ds-snmp-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
                  "product_id": "389-ds-snmp-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
                "product": {
                  "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
                  "product_id": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
                "product": {
                  "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
                  "product_id": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP6",
                  "product_id": "SUSE Linux Enterprise Server 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64"
        },
        "product_reference": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le"
        },
        "product_reference": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x"
        },
        "product_reference": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
        },
        "product_reference": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64"
        },
        "product_reference": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le"
        },
        "product_reference": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x"
        },
        "product_reference": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
        },
        "product_reference": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64"
        },
        "product_reference": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le"
        },
        "product_reference": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x"
        },
        "product_reference": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
        },
        "product_reference": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64"
        },
        "product_reference": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le"
        },
        "product_reference": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x"
        },
        "product_reference": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
        },
        "product_reference": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64"
        },
        "product_reference": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le"
        },
        "product_reference": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x"
        },
        "product_reference": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
        },
        "product_reference": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64"
        },
        "product_reference": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le"
        },
        "product_reference": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x"
        },
        "product_reference": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
        },
        "product_reference": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64"
        },
        "product_reference": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le"
        },
        "product_reference": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x"
        },
        "product_reference": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
        },
        "product_reference": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64"
        },
        "product_reference": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le"
        },
        "product_reference": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x"
        },
        "product_reference": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
        },
        "product_reference": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le"
        },
        "product_reference": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
        },
        "product_reference": "389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le"
        },
        "product_reference": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
        },
        "product_reference": "389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le"
        },
        "product_reference": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
        },
        "product_reference": "lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le"
        },
        "product_reference": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
        },
        "product_reference": "libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-9064",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-9064"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-9064",
          "url": "https://www.suse.com/security/cve/CVE-2026-9064"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265898 for CVE-2026-9064",
          "url": "https://bugzilla.suse.com/1265898"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:389-ds-devel-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:lib389-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libsvrcore0-2.2.10~git229.1fa7ffdb4-150600.8.29.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-16T13:29:41Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-9064"
    }
  ]
}

CVE-2026-9064 (GCVE-0-2026-9064)

Vulnerability from cvelistv5 – Published: 2026-05-20 09:00 – Updated: 2026-06-18 19:46

Title

389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)

Summary

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

redhat

References

19 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:26452	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26453	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26454	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26455	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26456	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26457	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26458	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26459	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26460	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26461	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26463	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26464	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26465	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26597	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26599	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26639	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27125	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-9064	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2480093	issue-trackingx_refsource_REDHAT

Impacted products

23 products

Vendor	Product	Version
Red Hat	Red Hat Directory Server 11.5 E4S for RHEL 8	Unaffected: 8060020260609102432.0ca98e7e , < * (rpm) cpe:/a:redhat:directory_server_e4s:11.5::el8
Red Hat	Red Hat Directory Server 11.7 E4S for RHEL 8	Unaffected: 8080020260610130252.f969626e , < * (rpm) cpe:/a:redhat:directory_server_e4s:11.7::el8
Red Hat	Red Hat Directory Server 11.9 for RHEL 8	Unaffected: 8100020260601104139.37ed7c03 , < * (rpm) cpe:/a:redhat:directory_server:11.9::el8
Red Hat	Red Hat Directory Server 12.2 E4S for RHEL 9	Unaffected: 9020020260615123354.1674d574 , < * (rpm) cpe:/a:redhat:directory_server_e4s:12.2::el9
Red Hat	Red Hat Directory Server 12.4 E4S for RHEL 9	Unaffected: 9040020260611130021.1674d574 , < * (rpm) cpe:/a:redhat:directory_server_e4s:12.4::el9
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.2.0-7.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:3.0.6-18.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.3.11.1-12.el7_9 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260601102239.25e700aa , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 8040020260609102422.96015a92 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 8040020260609102422.96015a92 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 8060020260609102416.824efc52 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 8060020260609102416.824efc52 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 8080020260610125847.6dbb3803 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 8080020260610125847.6dbb3803 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.8.0-7.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:2.2.4-18.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:2.4.5-25.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4::appstream
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:2.6.1-21.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6::appstream cpe:/a:redhat:rhel_eus:9.6::crb
Red Hat	Red Hat Directory Server 13.2	Unaffected: 1781714123 , < * (rpm) cpe:/a:redhat:directory_server:13.2::el10
Red Hat	Red Hat Directory Server 12	cpe:/a:redhat:directory_server:12
Red Hat	Red Hat Directory Server 13	cpe:/a:redhat:directory_server:13
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6

Date Public

2026-05-20 07:30

Credits

Red Hat would like to thank Oleh Konko (1seal.org) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9064",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-20T13:40:32.480479Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-20T13:41:09.059Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server_e4s:11.5::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-ds:11",
          "product": "Red Hat Directory Server 11.5 E4S for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020260609102432.0ca98e7e",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server_e4s:11.7::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-ds:11",
          "product": "Red Hat Directory Server 11.7 E4S for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8080020260610130252.f969626e",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server:11.9::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-ds:11",
          "product": "Red Hat Directory Server 11.9 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020260601104139.37ed7c03",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server_e4s:12.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-ds:12",
          "product": "Red Hat Directory Server 12.2 E4S for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "9020020260615123354.1674d574",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server_e4s:12.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-ds:12",
          "product": "Red Hat Directory Server 12.4 E4S for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "9040020260611130021.1674d574",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.2.0-7.el10_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux_eus:10.0"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.0.6-18.el10_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.3.11.1-12.el7_9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020260601102239.25e700aa",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8040020260609102422.96015a92",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8040020260609102422.96015a92",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020260609102416.824efc52",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020260609102416.824efc52",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8080020260610125847.6dbb3803",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4",
          "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8080020260610125847.6dbb3803",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.8.0-7.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.2.4-18.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.4.5-25.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::appstream",
            "cpe:/a:redhat:rhel_eus:9.6::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.6.1-21.el9_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:directory_server:13.2::el10"
          ],
          "defaultStatus": "affected",
          "packageName": "dirsrv/dirsrv-container-rhel10",
          "product": "Red Hat Directory Server 13.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1781714123",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server:12"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-ds:12/389-ds-base",
          "product": "Red Hat Directory Server 12",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server:13"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Directory Server 13",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Oleh Konko (1seal.org) for reporting this issue."
        }
      ],
      "datePublic": "2026-05-20T07:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-18T19:46:42.276Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:26452",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26452"
        },
        {
          "name": "RHSA-2026:26453",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26453"
        },
        {
          "name": "RHSA-2026:26454",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26454"
        },
        {
          "name": "RHSA-2026:26455",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26455"
        },
        {
          "name": "RHSA-2026:26456",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26456"
        },
        {
          "name": "RHSA-2026:26457",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26457"
        },
        {
          "name": "RHSA-2026:26458",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26458"
        },
        {
          "name": "RHSA-2026:26459",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26459"
        },
        {
          "name": "RHSA-2026:26460",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26460"
        },
        {
          "name": "RHSA-2026:26461",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26461"
        },
        {
          "name": "RHSA-2026:26463",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26463"
        },
        {
          "name": "RHSA-2026:26464",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26464"
        },
        {
          "name": "RHSA-2026:26465",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26465"
        },
        {
          "name": "RHSA-2026:26597",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26597"
        },
        {
          "name": "RHSA-2026:26599",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26599"
        },
        {
          "name": "RHSA-2026:26639",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26639"
        },
        {
          "name": "RHSA-2026:27125",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:27125"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-9064"
        },
        {
          "name": "RHBZ#2480093",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480093"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-05T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-05-20T07:30:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)",
      "workarounds": [
        {
          "lang": "en",
          "value": "Restrict network access to the LDAP port (389/tcp, 636/tcp) to trusted networks only using firewall rules or network ACLs. This prevents untrusted remote attackers from reaching the vulnerable code path.\n\nOptionally, lower the nsslapd-maxbersize configuration parameter to reduce the maximum BER message size accepted by the server. Note that this caps bytes, not the number of controls, and does not fully eliminate the amplification. Setting it too low may impact legitimate LDAP operations with large payloads."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-770: Allocation of Resources Without Limits or Throttling"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-9064",
    "datePublished": "2026-05-20T09:00:42.557Z",
    "dateReserved": "2026-05-20T08:19:21.037Z",
    "dateUpdated": "2026-06-18T19:46:42.276Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

SUSE-SU-2026:2418-1

CVE-2026-9064 (GCVE-0-2026-9064)

Tags

Sightings

Nomenclature