The vulnerability resides in the PBKDF2-SHA256 password storage plugin of 389 Directory Server, where an unbounded iteration count is accepted from stored password hashes. When a privileged attacker modifies or injects a password hash containing a very large iteration count, authentication attempts trigger excessive CPU usage, leading to service disruption for the entire directory server instance. The weakness is classified as Resource Exhaustion (CWE-400), and the impact manifests as a denial of service capable of affecting all users bound to the compromised account or the entire service, depending on resource constraints.

The affected products are Red Hat Directory Server versions 11, 12, and 13, as well as Red Hat Enterprise Linux releases 6 through 10. Any installation of these products that permits trusted users to set or alter userPassword attributes with the PBKDF2-SHA256 plugin is vulnerable, regardless of kernel or system version.

The published CVSS score of 4.9 indicates moderate severity, and the current EPSS score is not available, while the vulnerability is not listed in the CISA KEV catalog. The primary attack vector is internal or privileged modification of a hash; an attacker with Directory Manager privileges—or any role capable of editing userPassword fields—can create a poisoned hash that forces the server to perform an exorbitant number of PBKDF2 iterations during bind operations, exhausting CPU resources. Because the flaw requires direct modification of stored credentials, it is less likely to be exploited remotely without elevated privileges, but once in reach it can trigger an immediate denial of service.