The flaw resides in get_ldapmessage_controls_ext() of 389-ds-base, where the LDAP server does not enforce an upper bound on the number of controls per message. A remote, unauthenticated attacker can send an LDAP request packed with hundreds of thousands of minimal controls within the default 2‑MB BER size limit, provoking excessive CPU consumption and large heap allocations. Under sustained or concurrent exploitation the server may experience severe latency, worker‑thread starvation, or out‑of‑memory termination, ultimately causing a denial of service.

Affected products are Red Hat Directory Server versions 11, 12 and 13 as well as Red Hat Enterprise Linux releases 6, 7, 8, 9 and 10. These systems rely on the vulnerable 389-ds-base component.

The CVSS score of 7.5 indicates a moderate severity, and while an EPSS score is not available, the lack of a KEV listing suggests no publicly demonstrated exploits yet. The attack vector is remote, unauthenticated via the LDAP service on ports 389/636. Because the vulnerability accepts any number of controls, an attacker only needs network connectivity to the LDAP port and does not require privileged credentials. The resulting CPU and heap amplification can overwhelm service threads, making the server unresponsive to legitimate requests.