Executive brief
LLDAP, a lightweight LDAP server, is vulnerable to a flaw that allows an attacker to crash the service remotely. By sending a specially crafted request to the login or logout systems, an unauthorized user can force the application to shut down. This results in a denial of service, preventing legitimate users from logging in or accessing the directory service.
Technical details
A denial of service vulnerability exists in LLDAP v0.6.2 due to improper handling of non-ASCII bytes in HTTP headers. The 'get_refresh_token()' helper function in 'server/src/auth_service.rs', used by the '/auth/refresh' and '/auth/logout' routes, calls 'HeaderValue::to_str().unwrap()' on the 'refresh-token' header. If an attacker provides a header containing invalid UTF-8 sequences (such as 0xff), the 'unwrap()' call triggers a thread panic. In the default single-worker configuration, repeated unauthenticated requests can effectively disable the HTTP interface.
Affected products
- LLDAP LLDAP 0.6.2
Timeline
- 2026-06-13: disclosed: Initial discovery and PoC published on GitHub Gist.
- 2026-06-15: advisory: CVE-2026-50889 published by NVD.