A vulnerability was found in 389-ds-base (389 Directory Server). The function getldapmessagecontrolsext() in ldap/servers/slapd/control.c parses the optional LDAP v3 Controls field via a decode loop that allocates one LDAPControl struct per control element and grows the pointer list with repeated reallocations, but does not enforce a hard upper bound on the number of controls per message.

Under the default nsslapd-maxbersize of 2097152 (2 MB), a remote unauthenticated client can encode hundreds of thousands of minimal non-critical controls in a single LDAP request, forcing attacker-amplified CPU time and heap allocation. The control parsing occurs pre-authentication (e.g., during Bind request processing at bind.c:227), meaning no credentials are required to trigger the vulnerability.

Concurrency testing shows that with 4 concurrent 400000-controls Bind requests, heavy requests frequently exceed a 10-second client-side timeout, and independent small probes see latency spikes (baseline p50 ~3ms to stress p50 ~45ms). Sustained pressure can cause worker starvation or OOM termination.

This vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), similar in pattern to CVE-2019-10171 in 389-ds-base.

Upstream repository: https://github.com/389ds/389-ds-base Callsite: ldap/servers/slapd/control.c, function getldapmessagecontrolsext(), line 382-383 Bind entry: ldap/servers/slapd/bind.c, line 227 Confirmed at commit: 761452f79c30bbfd0d6756c4a8ed39549fde5717

Reported by: Oleh Konko of 1seal.org (security) Original report: PSIRTSUPT-6092