A null pointer dereference occurs in the deref control plugin’s BER parser in 389 Directory Server when the server is under memory pressure. The plugin does not verify that a BER structure is successfully allocated before use, which allows a remote attacker to send crafted LDAP requests and crash the server, causing a denial of service. The weakness is identified as a null pointer dereference (CWE-476) and affects availability with no direct impact on confidentiality or integrity.

Red Hat Directory Server versions 11 through 13 and all Red Hat Enterprise Linux distributions from 6 to 10 are impacted, since the vulnerable component is bundled within these products. The LDAP server component is the primary target of exploitation.

The vulnerability has a CVSS score of 5.9, indicating moderate risk. Because the EPSS score is not available, there is no current evidence of widespread exploitation. The flaw is not listed in CISA’s KEV catalog. Attackers can exploit the weakness remotely without authentication; the attack vector is likely an unauthenticated LDAP request that triggers the pointer dereference under memory pressure. While the vulnerability is not high severity, it can disrupt service availability on affected systems.