CVE-2026-22185

OpenLDAP LMDB mdb_load Heap Buffer Underflow in readline()

OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Openldap

Products

Openldap

CVE-2023-2953

openldap: null pointer dereference in ber_memalloc_x function

A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed

Vendors

Apple Netapp Openldap and 1 more

Products

Macos Active Iq Unified Manager Clustered Data Ontap and 15 more

CVE-2022-29155

openldap: OpenLDAP SQL injection

In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.

CVSS 3.1 · 9.8 Critical EPSS 64.5% KEV · Not listed

Vendors

Debian Netapp Openldap

Products

Debian Linux H300s H300s Firmware and 11 more

CVE-2021-27212

openldap: Assertion failure in slapd in the issuerAndThisUpdateCheck function

In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime.

CVSS 3.1 · 7.5 High EPSS 66.1% KEV · Not listed

Vendors

Debian Openldap

Products

Debian Linux Openldap

CVE-2020-36230

openldap: Assertion failure in ber_next_element in decode.c

A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 12.1% KEV · Not listed

Vendors

Apache Apple Debian and 1 more

Products

Bookkeeper Mac Os X Macos and 2 more

CVE-2020-36229

openldap: Type confusion in ad_keystring in ad.c

A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Apple Debian Openldap

Products

Mac Os X Macos Debian Linux and 1 more

CVE-2020-36228

openldap: Integer underflow in issuerAndThisUpdateCheck in schema_init.c

An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 85.0% KEV · Not listed

Vendors

Apple Debian Openldap

Products

Macos Debian Linux Openldap

CVE-2020-36227

openldap: Infinite loop in slapd with the cancel_extop Cancel operation

A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 77.2% KEV · Not listed

Vendors

Apple Debian Openldap

Products

Macos Debian Linux Openldap

CVE-2020-36226

openldap: Denial of service via length miscalculation in slap_parse_user

A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 4.2% KEV · Not listed

Vendors

Apple Debian Openldap

Products

Mac Os X Macos Debian Linux and 1 more

CVE-2020-36225

openldap: Double free in the saslAuthzTo processing

A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Apple Debian Openldap

Products

Macos Debian Linux Openldap

CVE-2020-36224

openldap: Invalid pointer free in the saslAuthzTo processing

A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Apple Debian Openldap

Products

Mac Os X Macos Debian Linux and 1 more

CVE-2020-36223

openldap: Out-of-bounds read in Values Return Filter

A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read).

CVSS 3.1 · 7.5 High EPSS 4.2% KEV · Not listed

Vendors

Apple Debian Openldap

Products

Mac Os X Macos Debian Linux and 1 more

CVE-2020-36222

openldap: Assertion failure in slapd in the saslAuthzTo validation

A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 77.2% KEV · Not listed

Vendors

Apple Debian Openldap

Products

Mac Os X Macos Debian Linux and 1 more

CVE-2020-36221

openldap: Integer underflow in serialNumberAndIssuerCheck in schema_init.c

An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck).

CVSS 3.1 · 7.5 High EPSS 85.0% KEV · Not listed

Vendors

Apple Debian Openldap

Products

Mac Os X Macos Debian Linux and 1 more

CVE-2020-25710

openldap: assertion failure in CSN normalization with invalid input

A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed

Vendors

Debian Fedoraproject Openldap and 1 more

Products

Debian Linux Fedora Openldap and 4 more

CVE-2020-25709

openldap: assertion failure in Certificate List syntax validation

A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.5 High EPSS 3.4% KEV · Not listed

Vendors

Apple Debian Openldap and 1 more

Products

Mac Os X Macos Debian Linux and 3 more

CVE-2020-25692

openldap: NULL pointer dereference for unauthenticated packet in slapd

A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service.

CVSS 3.1 · 7.5 High EPSS 3.1% KEV · Not listed

Vendors

Netapp Openldap Redhat

Products

Cloud Backup Solidfire Baseboard Management Controller Solidfire Baseboard Management Controller Firmware and 3 more

CVE-2020-12243

openldap: denial of service via nested boolean expressions in LDAP search filters

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

CVSS 3.1 · 7.5 High EPSS 4.7% KEV · Not listed

Vendors

Apple Broadcom Canonical and 6 more

Products

Mac Os X Brocade Fabric Operating System Ubuntu Linux and 25 more

CVE-2019-13565

openldap: ACL restrictions bypass due to sasl_ssf value being set permanently

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.

CVSS 3.1 · 7.5 High EPSS 5.0% KEV · Not listed

Vendors

Apple Canonical Debian and 4 more

Products

Mac Os X Ubuntu Linux Debian Linux and 6 more

CVE-2019-13057

openldap: Information disclosure issue in slapd component

An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)

CVSS 3.1 · 4.9 Medium EPSS 6.6% KEV · Not listed

Vendors

Apple Canonical Debian and 4 more

Products

Mac Os X Ubuntu Linux Debian Linux and 6 more