A heap‑buffer‑overflow flaw exists in the 389 Directory Server when normalizing a Distinguished Name that contains a legacy‑quoted multivalued nested Relative Distinguished Name. The flaw allows the server to write beyond the bounds of a heap allocation while sorting RDN attribute‑value pairs, corrupting heap memory. If triggered, the corruption can lead to a crash or instability of the directory service, resulting in a denial of service.

Red Hat Directory Server 11, 12, and 13, as well as Red Hat Enterprise Linux 6 through 10 that ship the 389‑ds‑base component, are all affected. Any instance running this component is potentially vulnerable, regardless of the specific operating system variant.

The attack vector is an unauthenticated remote LDAP operation: an attacker can supply a crafted base DN that triggers the DN normalization routine, such as a search with a specially formatted DN. The CVSS score of 5.3 indicates moderate severity focused on availability, and the EPSS score of < 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exposure of the LDAP port to external networks and knowledge of DN formatting are prerequisites for exploitation, which limits but does not eliminate the risk for publicly exposed Directory Server instances.