https://bugs.openldap.org/show_bug.cgi?id=10280
--- Comment #3 from Ondřej Kuzník ondra@mistotebe.net --- On Fri, Apr 10, 2026 at 02:27:54PM +0000, openldap-its@openldap.org wrote:
That was by design, this check https://git.openldap.org/openldap/openldap/-/blob/master/servers/slapd/overl... was to make sure we didn't expand the same value twice. Commenting that out is sufficient to make the example in this ticket work, but that opens the door to unbounded expansions, which could eat all of memory.
We could reuse the filter in multiple parts of the tree if we can ensure we're the ones in charge of freeing it. Or add a new filter type which defers this to the other one/a callback/...
Otherwise, shouldn't the search be rejected (and some documentation added) rather than letting it continue with a somewhat murky semantics?