389 Directory Server EUVD-2026-65312

Exploitation requires a valid LDAP authenticated session at low privilege (PR:L per CVSS vector) - any account capable of performing an LDAP bind is sufficient; no administrative or elevated permissions are needed. The attacker must have network-layer access to the LDAP service (AV:N, default ports 389 for LDAP or 636 for LDAPS). SASL must be in use for the authentication/connection in question, which is a common and typically default configuration in enterprise deployments of 389-ds-base. No user interaction is required (UI:N). The impact is strictly limited to server availability - no confidentiality or integrity compromise is described. Exploitation is further constrained to the scope of the directory server process itself (S:U); adjacent systems are not directly impacted by this vulnerability. The primary limiting factor is the requirement for prior authentication, even at minimal privilege level.

CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects a medium-severity, straightforward network attack requiring only low-privilege credentials. The high availability impact is significant: 389 Directory Server underpins LDAP authentication for enterprise Linux environments, so a successful DoS disrupts logins, service account lookups, and downstream SSO for all dependent systems. EPSS data is not present in the input, so exploitation probability cannot be quantified. No KEV listing and no identified POC code indicate no confirmed widespread exploitation, lowering urgency slightly. However, any authenticated LDAP user - including low-privilege service accounts, which are abundant in enterprise directories - can trigger the flaw, making the practical exploitation bar low once credentials are obtained. Under an SSVC lens: exploitation status is none confirmed, the attack is potentially automatable (single crafted request over the network), and technical impact is partial (availability only). The critical caveat is the CWE-787 tag: if a genuine out-of-bounds write primitive underlies the stall, the severity could be materially understated relative to the described DoS-only impact - this should be treated as an open question until the full Red Hat advisory clarifies.

An attacker who has compromised a low-privilege LDAP service account - or a malicious insider with any valid LDAP bind credential - connects to the directory server over the network and sends a specially crafted SASL UNBIND request designed to trigger the stall condition. By repeating this across multiple connections, the attacker exhausts server resources (connection threads, file descriptors, or memory), causing 389 Directory Server to become unresponsive to all subsequent LDAP clients. No public exploit code has been identified, but the low attack complexity (AC:L) and availability of the LDAP protocol specification make independent reproduction feasible for a skilled attacker.