CVE-2026-9064

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration.

Security Fix(es):

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.(CVE-2026-9064)

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration.

Security Fix(es):

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.(CVE-2026-9064)

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration.

Security Fix(es):

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.(CVE-2026-9064)

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration.

Security Fix(es):

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.(CVE-2026-9064)

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

• 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) (CVE-2026-9064)

Bug Fix(es) and Enhancement(s):

• Getting "build_candidate_list - Database error 11" messages after migrating to LMDB. [rhel-9.8.z] (JIRA:Rocky Linux-152356)

• Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. [rhel-9.8.z] (JIRA:Rocky Linux-168967)

• DS 12 does not handle escape char in bind user [rhel-9.8.z] (JIRA:Rocky Linux-170269)

• [RFE] Add OS-level thread names to all server threads [rhel-9.8.z] (JIRA:Rocky Linux-174524)

• Online export is failing when using the option "-s" [rhel-9.8.z] (JIRA:Rocky Linux-180716)

• Server shutdown during online reindex may lead to data loss [rhel-9.8.z] (JIRA:Rocky Linux-183895)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

• 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) (CVE-2026-9064)

Bug Fix(es) and Enhancement(s):

• DS 12 does not handle escape char in bind user [rhel-10.2.z] (JIRA:Rocky Linux-170271)

• dnaSharedConfig: "dnaPortNum: 0" [rhel-10.2.z] (JIRA:Rocky Linux-170276)

• Memory leaks in syncrepl plugin during persistent search operations [rhel-10.2.z] (JIRA:Rocky Linux-170281)

• access log - suspicious wtime optime negative and large values in internal op [rhel-10.2.z] (JIRA:Rocky Linux-170363)

• An online reinitialization with LMDB is terminating the receiving server [rhel-10.2.z] (JIRA:Rocky Linux-170478)

• dsctl healthcheck DSMOLE0001 inaccurate recommendations when there is more than 1 LDAP backend [rhel-10.2.z] (JIRA:Rocky Linux-170481)

• Possible memory leak when using the Retro Changelog plugin. [rhel-10.2.z] (JIRA:Rocky Linux-170515)

• [RFE] Add OS-level thread names to all server threads [rhel-10.2.z] (JIRA:Rocky Linux-174526)

• Online export is failing when using the option "-s" [rhel-10.2.z] (JIRA:Rocky Linux-180718)

• Server shutdown during online reindex may lead to data loss [rhel-10.2.z] (JIRA:Rocky Linux-183897)

• Error: NssSsl.add_cert() got an unexpected keyword argument 'input_file' [rhel-10.2.z] (JIRA:Rocky Linux-183898)

• Replication errors in logs [rhel-10.2.z] (JIRA:Rocky Linux-183899)

• Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured [rhel-10.2.z] (JIRA:Rocky Linux-183900)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

• 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) (CVE-2026-9064)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

• 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) (CVE-2026-9064)

Bug Fix(es) and Enhancement(s):

• Getting "build_candidate_list - Database error 11" messages after migrating to LMDB. [almalinux-9.8.z] (JIRA:AlmaLinux-152356)
• Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. [almalinux-9.8.z] (JIRA:AlmaLinux-168967)
• DS 12 does not handle escape char in bind user [almalinux-9.8.z] (JIRA:AlmaLinux-170269)
• [RFE] Add OS-level thread names to all server threads [almalinux-9.8.z] (JIRA:AlmaLinux-174524)
• Online export is failing when using the option "-s" [almalinux-9.8.z] (JIRA:AlmaLinux-180716)
• Server shutdown during online reindex may lead to data loss [almalinux-9.8.z] (JIRA:AlmaLinux-183895)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

• 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) (CVE-2026-9064)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2026-9064: fix resource starvation via excessive LDAP controls per operation

• CVE-2026-9064: limit number of LDAP controls per operation to prevent DoS

The updated packages fix a security vulnerability: Unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos). (CVE-2026-9064)

These are all security issues fixed in the 389-ds-3.1.4+e9d94d45a-1.1 package on the GA media of openSUSE Tumbleweed.

This update for 389-ds fixes the following issue

• CVE-2026-9064: unbounded LDAP controls count in get_ldapmessage_controls_ext() can lead to amplified CPU time and heap allocation and a denial of service (bsc#1265898).

Changes for 389-ds:

• Update to version 3.0.6~git337.647f49042:

• Issue 7541 - heap-buffer-overflows in __aclp__normalize_acltxt() (#7542)
• Issue 7531 - Fix LMDB replication regression_m2 failures and core dumps (#7575)
• Issue 7496 - fix cherry-pick error
• Issue 7490 - Enable USDT probes by default in RPM (#7491)
• Issue 7576 - Fix leak of temporary attribute syntax hash tables after schema reload
• Issue 7558 - During online import, the IDL should be created with in-depth first approach (#7559)
• Issue 7500 - Prevent unsigned integer underflow during stalled import
• Issue 7562 - Error: NssSsl.add_cert() got an unexpected keyword argument 'input_file' (#7563)
• Issue 7560 - lib389 - Add helper function for checking ASAN files
• Issue 7539 - Server shutdown during online reindex may lead to data loss (#7540)
• Issue 7549 - Substring index should validate minimum nsSubStrBegin/nsSubStrEnd values (#7550)
• Issue 7440 - Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured (#7441)
• Fix test389 imports on older branches
• Issue 7267 - MDB_BAD_VALSIZE error when updating index (#7268)
• Issue 7327 - dsctl healthcheck DSMOLE0001 inaccurate recommendations with multiple backends (#7328)
• Issue 7372 - Reindex adds tombstones to ancestorid causing export failures (#7373)
• Issue 7437 - LeakSanitizer: memory leaks in CoS cache error paths (#7438)
• Issue 6922 - AddressSanitizer: leaks found by acl test suite
• Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7556)
• Issue 7554 - deref plugin null pointer dereference if ber_init fails
• Issue 7493 - RFE - Add ShadowAccount fixup task
• Issue 7507 - UI - cleanup style and alignments
• Issue 7514 - Crash when doing moddn on very large subtree
• Issue 7516 - dblayer_bulk_nextdata should not return an error when maxrecords is hit
• Issue 7496 - Fix latest GCC compiler warnings
• Issue 7503 - CVE-2026-9064 - Add a limit to the number controls per operation
• Issue 7300 - RFE - Add OS-level thread names to all server threads (#7301)
• Issue 7307 - RFE - Expose work queue and worker utilization metrics (#7308)
• Issue 7464 - CLI - allow dsidm to work with other user types
• Issue 7457 - Refactor memberOf perf test (#7458)
• Issue 7452 - UI - password polices - reorganize settings
• Issue 7431 - password policy - passwordBadWords is ignored in local policies
• Issue 7155 - build_candidate_list - Database error 11 with range search (#7156)
• Issue 7426 - logconv.py is out of sync with server-emitted note codes (#7427)
• Issue 7417 - UI - global password policy syntax settings missing passwordMaxRepeats
• Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7411)
• Issue 7088 - Change log level for "Can't locate CSN" error message
• Issue 7423 - cleanup pblock after freeing pre/post entries
• Issue 7418 - Use-after-free in deferred memberof (#7419)
• Issue 7407 - dbscan -k option - fix cherry-pick error
• Issue 7407 - dbscan -k option display entries that do not match the specified key
• Issue 7404 - fix latest compiler warnings(cherry-pick issue)
• Issue 7404 - fix latest compiler warnings
• Issue 7394 - UI - Manual typing of ports can leave out digits (#7395)
• Issue 7277 - UI - Fix Japanese translation errors errors in Cockpit UI (#7386)
• Issue 7246 - correct formatting of 'Gen as CSN' in dsctl get-nsstate output (#7247)
• Issue 7126 - WARN - keys2idl - received NULL idl from index_read_ext_allids (#7127)
• Issue 7370 - Runtime LSan/TSan injection for pytest (#7371)
• Issue 7378 - Make sure suffix entry always gets assigned ID 1
• Issue 7380 - Internal op with negative wtime and large optime (#7381)
• Issue 7362 - UI - Some…

This update for 389-ds fixes the following issue

• CVE-2026-9064: unbounded LDAP controls count in get_ldapmessage_controls_ext() can lead to amplified CPU time and heap allocation and a denial of service (bsc#1265898).

Changes for 389-ds:

• Update to version 3.0.6~git337.647f49042:

• Issue 7541 - heap-buffer-overflows in __aclp__normalize_acltxt() (#7542)
• Issue 7531 - Fix LMDB replication regression_m2 failures and core dumps (#7575)
• Issue 7496 - fix cherry-pick error
• Issue 7490 - Enable USDT probes by default in RPM (#7491)
• Issue 7576 - Fix leak of temporary attribute syntax hash tables after schema reload
• Issue 7558 - During online import, the IDL should be created with in-depth first approach (#7559)
• Issue 7500 - Prevent unsigned integer underflow during stalled import
• Issue 7562 - Error: NssSsl.add_cert() got an unexpected keyword argument 'input_file' (#7563)
• Issue 7560 - lib389 - Add helper function for checking ASAN files
• Issue 7539 - Server shutdown during online reindex may lead to data loss (#7540)
• Issue 7549 - Substring index should validate minimum nsSubStrBegin/nsSubStrEnd values (#7550)
• Issue 7440 - Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured (#7441)
• Fix test389 imports on older branches
• Issue 7267 - MDB_BAD_VALSIZE error when updating index (#7268)
• Issue 7327 - dsctl healthcheck DSMOLE0001 inaccurate recommendations with multiple backends (#7328)
• Issue 7372 - Reindex adds tombstones to ancestorid causing export failures (#7373)
• Issue 7437 - LeakSanitizer: memory leaks in CoS cache error paths (#7438)
• Issue 6922 - AddressSanitizer: leaks found by acl test suite
• Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7556)
• Issue 7554 - deref plugin null pointer dereference if ber_init fails
• Issue 7493 - RFE - Add ShadowAccount fixup task
• Issue 7507 - UI - cleanup style and alignments
• Issue 7514 - Crash when doing moddn on very large subtree
• Issue 7516 - dblayer_bulk_nextdata should not return an error when maxrecords is hit
• Issue 7496 - Fix latest GCC compiler warnings
• Issue 7503 - CVE-2026-9064 - Add a limit to the number controls per operation
• Issue 7300 - RFE - Add OS-level thread names to all server threads (#7301)
• Issue 7307 - RFE - Expose work queue and worker utilization metrics (#7308)
• Issue 7464 - CLI - allow dsidm to work with other user types
• Issue 7457 - Refactor memberOf perf test (#7458)
• Issue 7452 - UI - password polices - reorganize settings
• Issue 7431 - password policy - passwordBadWords is ignored in local policies
• Issue 7155 - build_candidate_list - Database error 11 with range search (#7156)
• Issue 7426 - logconv.py is out of sync with server-emitted note codes (#7427)
• Issue 7417 - UI - global password policy syntax settings missing passwordMaxRepeats
• Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7411)
• Issue 7088 - Change log level for "Can't locate CSN" error message
• Issue 7423 - cleanup pblock after freeing pre/post entries
• Issue 7418 - Use-after-free in deferred memberof (#7419)
• Issue 7407 - dbscan -k option - fix cherry-pick error
• Issue 7407 - dbscan -k option display entries that do not match the specified key
• Issue 7404 - fix latest compiler warnings(cherry-pick issue)
• Issue 7404 - fix latest compiler warnings
• Issue 7394 - UI - Manual typing of ports can leave out digits (#7395)
• Issue 7277 - UI - Fix Japanese translation errors errors in Cockpit UI (#7386)
• Issue 7246 - correct formatting of 'Gen as CSN' in dsctl get-nsstate output (#7247)
• Issue 7126 - WARN - keys2idl - received NULL idl from index_read_ext_allids (#7127)
• Issue 7370 - Runtime LSan/TSan injection for pytest (#7371)
• Issue 7378 - Make sure suffix entry always gets assigned ID 1
• Issue 7380 - Internal op with negative wtime and large optime (#7381)
• Issue 7362 - UI - Some…

This update for 389-ds fixes the following issue

• CVE-2026-9064: unbounded LDAP controls count in get_ldapmessage_controls_ext() can lead to amplified CPU time and heap allocation and a denial of service (bsc#1265898).

Changes for 389-ds:

• Update to version 2.0.20~git90.9f70d434e.

This update for 389-ds fixes the following issue

Update to 2.2.10~git229.1fa7ffdb4:

• CVE-2026-9064: unbounded LDAP controls count in get_ldapmessage_controls_ext() can lead to amplified CPU time and heap allocation and a denial of service (bsc#1265898).

Changelog:

• Issue 7503 - CVE-2026-9064 - Add a limit to the number controls per operation
• Issue 7457 - Refactor memberOf perf test (#7458)
• Issue 7431 - password policy - passwordBadWords is ignored in local policies
• Issue 7417 - UI - global password policy syntax settings missing passwordMaxRepeats
• Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7411)
• Issue 7088 - Change log level for 'Can't locate CSN' error message
• Issue 7423 - cleanup pblock after freeing pre/post entries
• Issue 7418 - Use-after-free in deferred memberof (#7419)
• Issue 7277 - UI - Fix Japanese translation errors errors in Cockpit UI (#7386)
• Issue 7126 - WARN - keys2idl - received NULL idl from index_read_ext_allids (#7127)
• Issue 7370 - Runtime LSan/TSan injection for pytest (#7371)
• Issue 7378 - Make sure suffix entry always gets assigned ID 1
• Issue 7380 - Internal op with negative wtime and large optime (#7381)
• Issue 7362 - UI - Some FormSelect onChange parameters are reversed
• Issue 7368 - UI - global password policy page is missing passwordmintokenlength
• Issue 7366 - Memory leaks in syncrepl plugin during persistent search operations (#7367)
• Issue 7284 - CI - Fix test_grace_limit_section after pwpolicy validation fix (#7357)
• Issue 3555 - UI - Fix audit issue with npm - flatted, picomatch (#7364)
• Issue 1704 - DNA plugin creates invalid shared config entry with port 0 (#7352)
• Issue 6753 - Removing ticket 477828 test and porting to DSLdapObject (#6989)
• Issue 7342 - CI - repl config regression (#7343)
• Issue 7319 - Action menu for certificates remains in empty certificate list (#7320)
• Issue 6868 - UI - schema attribute table expansion break after moving to a new page
• Issue 7093 - A password policy can be created even when an identical policy already exists (#7283)
• Issue 7233 - test_produce_division_by_zero fails with IsADirectoryError in conftest.py (#7234)
• Issue 7152 - ns-slapd fails to shutdown when deferred memberof update is in progress (#7187)
• Issue 3555 - UI - Fix audit issue with npm - ajv, minimatch (#7298)
• Issue 7291 - Crash when configuring a replica with an incorrect nsds5ReplicaRoot (#7292)
• Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7285)

This update for 389-ds fixes the following issue

Update to 2.2.10~git229.1fa7ffdb4:

• CVE-2026-9064: unbounded LDAP controls count in get_ldapmessage_controls_ext() can lead to amplified CPU time and heap allocation and a denial of service (bsc#1265898).

Changelog:

• Issue 7503 - CVE-2026-9064 - Add a limit to the number controls per operation
• Issue 7457 - Refactor memberOf perf test (#7458)
• Issue 7431 - password policy - passwordBadWords is ignored in local policies
• Issue 7417 - UI - global password policy syntax settings missing passwordMaxRepeats
• Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7411)
• Issue 7088 - Change log level for 'Can't locate CSN' error message
• Issue 7423 - cleanup pblock after freeing pre/post entries
• Issue 7418 - Use-after-free in deferred memberof (#7419)
• Issue 7277 - UI - Fix Japanese translation errors errors in Cockpit UI (#7386)
• Issue 7126 - WARN - keys2idl - received NULL idl from index_read_ext_allids (#7127)
• Issue 7370 - Runtime LSan/TSan injection for pytest (#7371)
• Issue 7378 - Make sure suffix entry always gets assigned ID 1
• Issue 7380 - Internal op with negative wtime and large optime (#7381)
• Issue 7362 - UI - Some FormSelect onChange parameters are reversed
• Issue 7368 - UI - global password policy page is missing passwordmintokenlength
• Issue 7366 - Memory leaks in syncrepl plugin during persistent search operations (#7367)
• Issue 7284 - CI - Fix test_grace_limit_section after pwpolicy validation fix (#7357)
• Issue 3555 - UI - Fix audit issue with npm - flatted, picomatch (#7364)
• Issue 1704 - DNA plugin creates invalid shared config entry with port 0 (#7352)
• Issue 6753 - Removing ticket 477828 test and porting to DSLdapObject (#6989)
• Issue 7342 - CI - repl config regression (#7343)
• Issue 7319 - Action menu for certificates remains in empty certificate list (#7320)
• Issue 6868 - UI - schema attribute table expansion break after moving to a new page
• Issue 7093 - A password policy can be created even when an identical policy already exists (#7283)
• Issue 7233 - test_produce_division_by_zero fails with IsADirectoryError in conftest.py (#7234)
• Issue 7152 - ns-slapd fails to shutdown when deferred memberof update is in progress (#7187)
• Issue 3555 - UI - Fix audit issue with npm - ajv, minimatch (#7298)
• Issue 7291 - Crash when configuring a replica with an incorrect nsds5ReplicaRoot (#7292)
• Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7285)

This update for 389-ds fixes the following issue

Update to 2.7.0~git193.9ab79d496:

• CVE-2026-9064: unbounded LDAP controls count in get_ldapmessage_controls_ext() can lead to amplified CPU time and heap allocation and a denial of service (bsc#1265898).

Changelog:

• Issue 7503 - CVE-2026-9064 - Add a limit to the number controls per operation
• Issue 7300 - RFE - Add OS-level thread names to all server threads (#7301)
• Issue 7307 - RFE - Expose work queue and worker utilization metrics (#7308)
• Issue 7464 - CLI - allow dsidm to work with other user types
• Issue 7457 - Refactor memberOf perf test (#7458)
• Issue 7452 - UI - password polices - reorganize settings
• Issue 7431 - password policy - passwordBadWords is ignored in local policies
• Issue 7155 - build_candidate_list - Database error 11 with range search (#7156)
• Issue 7417 - UI - global password policy syntax settings missing passwordMaxRepeats
• Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7411)
• Issue 7088 - Change log level for 'Can't locate CSN' error message
• Issue 7423 - cleanup pblock after freeing pre/post entries
• Issue 7418 - Use-after-free in deferred memberof (#7419)
• Issue 7407 - dbscan -k option display entries that do not match the specified key
• Issue 7394 - UI - Manual typing of ports can leave out digits (#7395)
• Issue 7277 - UI - Fix Japanese translation errors errors in Cockpit UI (#7386)
• Issue 7126 - WARN - keys2idl - received NULL idl from index_read_ext_allids (#7127)
• Issue 7370 - Runtime LSan/TSan injection for pytest (#7371)
• Issue 7378 - Make sure suffix entry always gets assigned ID 1
• Issue 7380 - Internal op with negative wtime and large optime (#7381)
• Issue 7362 - UI - Some FormSelect onChange parameters are reversed
• Issue 7368 - UI - global password policy page is missing passwordmintokenlength
• Issue 7366 - Memory leaks in syncrepl plugin during persistent search operations (#7367)
• Issue 7284 - CI - Fix test_grace_limit_section after pwpolicy validation fix (#7357)
• Issue 7271 - Add test for retrocl trimming shutdown crash (#7356)
• Issue 3555 - UI - Fix audit issue with npm - flatted, picomatch (#7364)
• Issue 1704 - DNA plugin creates invalid shared config entry with port 0 (#7352)
• Issue 6753 - Removing ticket 477828 test and porting to DSLdapObject (#6989)
• Issue 7346 - DS does not handle escape char in bind user (#7347)
• Issue 7322 - Fix cherry-pick error (reject repl agmt that points to itself)
• Issue 7322 - Reject adding a replication agreement that points to itself
• Issue 7342 - CI - repl config regression (#7343)
• Issue - UI - Improve suffix import LDIF table
• Issue 7325 - UI - new error parser missing import
• Issue 7325 - UI - create an error parser for cockpit spawn errors
• Issue 7319 - Action menu for certificates remains in empty certificate list (#7320)
• Issue 7265 - CI - fix retro changelog maxage validation test
• Issue 7093 - A password policy can be created even when an identical policy already exists (#7283)
• Issue 7233 - test_produce_division_by_zero fails with IsADirectoryError in conftest.py (#7234)
• Issue 7271 - Add new plugin pre-close function check to plugin_invoke_plugin_pb
• Issue 7304 - retrocl should not cache DN
• Issue 7265 - Add dse modify callback to validate retrocl trimming settings
• Issue 7152 - ns-slapd fails to shutdown when deferred memberof update is in progress (#7187)
• Issue 3555 - UI - Fix audit issue with npm - ajv, minimatch (#7298)
• Issue 7271 - implement a pre-close plugin function
• Issue 7291 - Crash when configuring a replica with an incorrect nsds5ReplicaRoot (#7292)
• Issue 7295 - changelog max age validation cherry-pick error
• Issue 7265 - changelog maxage validation is not strict enough
• Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7285)