Executive brief
A vulnerability in the 389 Directory Server, a popular enterprise-grade LDAP server, allows an attacker to crash or slow down the service. By sending a specially crafted request with an excessive number of internal instructions, an attacker can force the server to consume all available memory and processor power. This can be done without a username or password, potentially leading to a total service outage for all users and applications that rely on the directory for authentication.
Technical details
The vulnerability exists in the get_ldapmessage_controls_ext() function within ldap/servers/slapd/control.c of 389-ds-base. The server fails to enforce an upper bound on the number of LDAP controls processed per message, leading to a CWE-770 (Allocation of Resources Without Limits or Throttling) condition. An unauthenticated attacker can exploit this by sending a request (such as a Bind request) containing hundreds of thousands of minimal controls within the default 2MB message size limit. This results in repeated heap reallocations and high CPU usage, causing worker thread starvation, significant latency spikes, or out-of-memory (OOM) termination.
Affected products
- 389 Directory Server Project 389-ds-base
Timeline
- 2026-05-20: disclosed: Initial report by Oleh Konko of 1seal.org
- 2026-05-20: advisory: NVD and Red Hat advisories published