Executive brief
A vulnerability in the 389 Directory Server, a popular enterprise-grade LDAP server, could allow an authenticated user to crash the system. By initiating a specific type of search and then refusing to receive the results, a user can force the server to consume all available memory. This leads to a denial-of-service condition, disrupting directory services and any applications that rely on them for authentication or lookups.
Technical details
The Content Synchronization (syncrepl) persistent search plugin in 389 Directory Server contains three primary flaws in sync_persist.c. The most significant is an uncontrolled resource consumption issue (CWE-400) where modification events are queued without limit if an authenticated client stops reading sync responses, leading to memory exhaustion. Additionally, the plugin suffers from a dangling pointer race condition during connection teardown and non-atomic thread count increments on weak memory model architectures. These issues allow a remote authenticated attacker to trigger a server crash or denial-of-service. As of the advisory date, no upstream fix was confirmed, though the issue is tracked by Red Hat.
Affected products
- Red Hat 389 Directory Server All versions prior to fix
Timeline
- 2026-06-05: disclosed: Initial report in Red Hat Bugzilla
- 2026-06-08: advisory: NVD publication date