Description of the patch:
This update for 389-ds fixes the following issue
- CVE-2026-9064: unbounded LDAP controls count in
get_ldapmessage_controls_ext() can lead to amplified CPU time and
heap allocation and a denial of service (bsc#1265898).
Changes for 389-ds:
- Update to version 3.0.6~git337.647f49042:
- Issue 7541 - heap-buffer-overflows in __aclp__normalize_acltxt() (#7542)
- Issue 7531 - Fix LMDB replication regression_m2 failures and core dumps (#7575)
- Issue 7496 - fix cherry-pick error
- Issue 7490 - Enable USDT probes by default in RPM (#7491)
- Issue 7576 - Fix leak of temporary attribute syntax hash tables after schema reload
- Issue 7558 - During online import, the IDL should be created with in-depth first approach (#7559)
- Issue 7500 - Prevent unsigned integer underflow during stalled import
- Issue 7562 - Error: NssSsl.add_cert() got an unexpected keyword argument 'input_file' (#7563)
- Issue 7560 - lib389 - Add helper function for checking ASAN files
- Issue 7539 - Server shutdown during online reindex may lead to data loss (#7540)
- Issue 7549 - Substring index should validate minimum nsSubStrBegin/nsSubStrEnd values (#7550)
- Issue 7440 - Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd
lengths are configured (#7441)
- Fix test389 imports on older branches
- Issue 7267 - MDB_BAD_VALSIZE error when updating index (#7268)
- Issue 7327 - dsctl healthcheck DSMOLE0001 inaccurate recommendations with multiple backends (#7328)
- Issue 7372 - Reindex adds tombstones to ancestorid causing export failures (#7373)
- Issue 7437 - LeakSanitizer: memory leaks in CoS cache error paths (#7438)
- Issue 6922 - AddressSanitizer: leaks found by acl test suite
- Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7556)
- Issue 7554 - deref plugin null pointer dereference if ber_init fails
- Issue 7493 - RFE - Add ShadowAccount fixup task
- Issue 7507 - UI - cleanup style...