Executive brief
A vulnerability in the 389 Directory Server, a popular enterprise identity management service, allows an administrator to crash or freeze the system. By setting an extremely high security calculation requirement on a user account, an attacker can force the server to spend hours of processing power on a single login attempt. This results in a denial of service, preventing legitimate users from accessing the network or logging into their accounts.
Technical details
A resource exhaustion vulnerability exists in the PBKDF2-SHA256 password storage plugin of 389 Directory Server. The plugin (implemented in both C and Rust) extracts the iteration count from stored password hashes without enforcing an upper bound. An attacker with Directory Manager privileges can modify a user's password hash to include an extreme iteration count (e.g., 0x7FFFFFFF). Subsequent LDAP BIND operations against the affected account trigger unbounded CPU consumption, hanging worker threads and leading to a persistent denial of service. This issue is distinct from CVE-2024-5953, which addressed hash length but not iteration limits.
Affected products
- Red Hat 389 Directory Server (389-ds-base) 1.3.6 and later
Timeline
- 2026-06-05: disclosed: Reported via Red Hat Bugzilla
- 2026-06-09: advisory: NVD and Red Hat published advisory details