Release 389-ds-base-3.2.0-7.el10_2 ALSA-2026:26456

389-ds-base security, bug fix, and enhancement update
Severity: Important
Description
389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

* 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) (CVE-2026-9064)

Bug Fix(es) and Enhancement(s):

* DS 12 does not handle escape char in bind user [almalinux-10.2.z] (JIRA:AlmaLinux-170271)
* dnaSharedConfig: "dnaPortNum: 0" [almalinux-10.2.z] (JIRA:AlmaLinux-170276)
* Memory leaks in syncrepl plugin during persistent search operations [almalinux-10.2.z] (JIRA:AlmaLinux-170281)
* access log - suspicious wtime optime negative and large values in internal op [almalinux-10.2.z] (JIRA:AlmaLinux-170363)
* An online reinitialization with LMDB is terminating the receiving server [almalinux-10.2.z] (JIRA:AlmaLinux-170478)
* dsctl healthcheck DSMOLE0001 inaccurate recommendations when there is more than 1 LDAP backend [almalinux-10.2.z] (JIRA:AlmaLinux-170481)
* Possible memory leak when using the Retro Changelog plugin. [almalinux-10.2.z] (JIRA:AlmaLinux-170515)
* [RFE] Add OS-level thread names to all server threads [almalinux-10.2.z] (JIRA:AlmaLinux-174526)
* Online export is failing when using the option "-s" [almalinux-10.2.z] (JIRA:AlmaLinux-180718)
* Server shutdown during online reindex may lead to data loss [almalinux-10.2.z] (JIRA:AlmaLinux-183897)
* Error: NssSsl.add_cert() got an unexpected keyword argument 'input_file' [almalinux-10.2.z] (JIRA:AlmaLinux-183898)
* Replication errors in logs [almalinux-10.2.z] (JIRA:AlmaLinux-183899)
* Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured [almalinux-10.2.z] (JIRA:AlmaLinux-183900)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected packages:
389-ds-base-3.2.0-7.el10_2.x86_64
389-ds-base-libs-3.2.0-7.el10_2.x86_64
389-ds-base-snmp-3.2.0-7.el10_2.x86_64
python3-lib389-3.2.0-7.el10_2.noarch
389-ds-base-3.2.0-7.el10_2.s390x
389-ds-base-libs-3.2.0-7.el10_2.s390x
389-ds-base-snmp-3.2.0-7.el10_2.s390x
python3-lib389-3.2.0-7.el10_2.noarch
389-ds-base-3.2.0-7.el10_2.ppc64le
389-ds-base-libs-3.2.0-7.el10_2.ppc64le
389-ds-base-snmp-3.2.0-7.el10_2.ppc64le
python3-lib389-3.2.0-7.el10_2.noarch
389-ds-base-3.2.0-7.el10_2.aarch64
389-ds-base-libs-3.2.0-7.el10_2.aarch64
389-ds-base-snmp-3.2.0-7.el10_2.aarch64
python3-lib389-3.2.0-7.el10_2.noarch
389-ds-base-bdb-3.2.0-7.el10_2.x86_64
389-ds-base-devel-3.2.0-7.el10_2.x86_64
389-ds-base-bdb-3.2.0-7.el10_2.ppc64le
389-ds-base-devel-3.2.0-7.el10_2.ppc64le
389-ds-base-bdb-3.2.0-7.el10_2.aarch64
389-ds-base-devel-3.2.0-7.el10_2.aarch64
389-ds-base-bdb-3.2.0-7.el10_2.s390x
389-ds-base-devel-3.2.0-7.el10_2.s390x
389-ds-base-3.2.0-7.el10_2.x86_64_v2
389-ds-base-libs-3.2.0-7.el10_2.x86_64_v2
389-ds-base-snmp-3.2.0-7.el10_2.x86_64_v2
389-ds-base-bdb-3.2.0-7.el10_2.x86_64_v2
389-ds-base-devel-3.2.0-7.el10_2.x86_64_v2
python3-lib389-3.2.0-7.el10_2.noarch