CyberRota Analysis
AI-GeneratedA vulnerability in 389-ds-base allows unauthenticated remote attackers to exploit LDAP operations, leading to a denial-of-service condition by exhausting the server's worker-thread pool. This impacts all clients, both anonymous and authenticated, regardless of connection security (plaintext or TLS). Organizations using 389-ds-base should prioritize addressing this issue to prevent service disruptions.
Original NVD Description
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.