Description
The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openldap | 2.4.39-1.1 | — |
| Debian 13 | openldap | 2.4.39-1.1 | — |
| Debian 12 | openldap | 2.4.39-1.1 | — |
| Debian 7 | openldap | 2.4.31-2 | DSA-3209-1 |
| Debian 6.0 | openldap | 2.4.23-7.3+deb6u1 | DLA-203-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | openldap | 2.4.31-1+nmu2ubuntu8.1 | USN-2622-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | openldap +4 | 2.4.23-34.el6_5.1 | RHSA-2014:0126 |
| RHEL 5 | compat-openldap | 2.3.43_2.2.29-27.el5_10 | RHSA-2014:0206 |
| RHEL 5 | openldap +5 | 2.3.43-27.el5_10 | RHSA-2014:0206 |
Advisories 5
- RHSA-2014:0206 Red Hat Security Advisory: openldap security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2014:0126 Red Hat Security Advisory: openldap security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-2622-1 openldap vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-203-1 openldap - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3209-1 openldap - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.openldap.org/its/index.cgi/Incoming?id=7723
- MDVSA-2014:026 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1019490
- DSA-3209 vendor-advisory
- RHSA-2014:0126 vendor-advisory
- [oss-security] 20131018 Re: CVE request: slapd segfaults on certain queries with rwm overlay enabled mailing-list
- RHSA-2014:0206 vendor-advisory
- 63190 vdb-entry
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- 1029711 vdb-entry
- 20140401 Cisco Unified Communications Manager Denial of Service Vulnerability vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
- https://support.apple.com/kb/HT210788
- 20191211 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra mailing-list
- 20191213 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra mailing-list