SUSE 389-ds Important Denial of Service Vuln 2026-2417

Back Linuxsecurity

SUSE 389-ds Important Denial of Service Vuln 2026-2417

Linuxsecurity •LinuxSecurity Advisories • June 17, 2026

Share: View original

## This update for 389-ds fixes the following issue Update to 2.2.10~git229.1fa7ffdb4: * CVE-2026-9064: unbounded LDAP controls count in `get_ldapmessage_controls_ext()` can lead to amplified CPU time and heap allocation and a denial of service (bsc#1265898). Changelog: * Issue 7503 - CVE-2026-9064 - Add a limit to the number controls per operation * Issue 7457 - Refactor memberOf perf test (#7458) * Issue 7431 - password policy - passwordBadWords is ignored in local policies * Issue 7417 - UI - global password policy syntax settings missing passwordMaxRepeats * Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7411) * Issue 7088 - Change log level for "Can't locate CSN" error message * Issue 7423 - cleanup pblock after freeing pre/post entries * Issue 7418 - Use-after-free in deferred memberof (#7419)

## This update for 389-ds fixes the following issue Update to 2.2.10~git229.1fa7ffdb4: * CVE-2026-9064: unbounded LDAP controls count in `get_ldapmessage_controls_ext()` can lead to amplified CPU time and heap allocation and a denial of service (bsc#1265898). Changelog: * Issue 7503 - CVE-2026-9064 - Add a limit to the number controls per operation * Issue 7457 - Refactor memberOf perf test (#7458) * Issue 7431 - password policy - passwordBadWords is ignored in local policies * Issue 7417 - UI - global password policy syntax settings missing passwordMaxRepeats * Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7411) * Issue 7088 - Change log level for "Can't locate CSN" error message * Issue 7423 - cleanup pblock after freeing pre/post entries * Issue 7418 - Use-after-free in deferred memberof (#7419)

* CVE-2026-9064 ( SUSE ): 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2026-9064 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-9064 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* SUSE Linux Enterprise High Performance Computing 15 SP5

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5

* SUSE Linux Enterprise Server 15 SP5

* SUSE Linux Enterprise Server 15 SP5 LTSS

* SUSE Linux Enterprise Server for SAP Applications 15 SP5

An update that solves one vulnerability can now be installed.

*

Announcement ID: SUSE-SU-2026:2417-1 Release Date: 2026-06-16T13:29:22Z Rating: important

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SUSE 389-ds Denial of Service Vulnerability CVE-2026-9064 Disclosed SUSE has released updates for the 389-ds directory server to address a critical denial of service vulnerability, CVE-2026-9064. This vulnerability allows unbounded LDAP controls in the `get_ldapmessage_controls_ext()` function, potentially leading to amplified CPU usage and heap allocation issues. Affected systems include SUSE Linux Enterprise Server and various high-performance computing modules. The vulnerability was published on May 20, 2026, and is rated important. The updates are designed to limit the number of controls per operation to mitigate the risk. Administrators are advised to apply the patches immediately to prevent potential service disruptions. The CVSS scores for this vulnerability range from 3.1 to 4.0, indicating a moderate to high risk level. The updates were released on June 16, 2026. 3 sources 58

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (6)

389-ds SUSE Linux Enterprise High Performance Computing 15 SP5 SUSE Linux Enterprise High Performance Computing Espos 15 SP5 SUSE Linux Enterprise Server 15 SP5 SUSE Linux Enterprise Server 15 SP5 LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP5