The vulnerability resides in the Content Synchronization persistent search plugin of 389 Directory Server. An authenticated client that stops consuming sync responses can cause the plugin to allocate memory without bounds, leading to a service denial. Concurrently, race conditions in the plugin’s thread lifecycle may trigger crashes during connection teardown or server shutdown, further disrupting availability. The weakness is catalogued as CWE‑400, indicating a resource exhaustion flaw.

Red Hat Directory Server versions 11, 12, and 13, as well as Red Hat Enterprise Linux releases 6 through 10, are affected. The flaw impacts systems where the Content Synchronization plugin is enabled and accessed by authenticated clients.

The CVSS score of 6.5 classifies the defect as medium severity; the EPSS score is not available, indicating no current exploitation data. The vulnerability is not listed in the CISA KEV catalog. Attack requires authentication against the Directory Server, so the threat model is that an attacker with valid credentials may abuse the plugin to exhaust memory or force crashes. Once exploited, the server will become unavailable to legitimate clients until a restart or manual cleanup occurs.