The vulnerability in 389 Directory Server arises because the dereference control plugin fails to verify that ber_init() succeeded before using the BER structure. If memory allocation fails under pressure, an LDAP search with the deref control can cause a NULL pointer dereference, crashing the ns-slapd LDAP server process. This issue can be triggered by unauthenticated remote attackers when anonymous access is enabled. Red Hat rates the impact as moderate with a CVSS score of 5.9, noting that the crash requires memory pressure conditions and is not triggered by crafted payloads alone. Disabling the deref plugin or anonymous access mitigates the vulnerability. Red Hat has issued an important security update fixing this flaw in 389-ds-base packages for RHEL 9.2 and related products.

The vulnerability results in a denial of service (DoS) condition by crashing the LDAP server (ns-slapd) when memory allocation fails during processing of the deref control plugin. There is no impact on confidentiality or integrity. The crash can be triggered remotely by unauthenticated attackers if anonymous access is enabled. The issue requires high attack complexity due to the need for memory pressure to cause allocation failure. No known exploits are reported in the wild.

Red Hat has released an official security update fixing this vulnerability in the 389-ds-base package. Applying the update is the recommended remediation. Alternatively, disabling the deref plugin entirely removes the vulnerable code path (using 'dsconf <instance> plugin deref disable' and restarting the directory server). Disabling anonymous access (setting 'nsslapd-allow-anonymous-access=off') raises the exploitation bar from unauthenticated to authenticated. Additional defense-in-depth includes configuring memory limits (nsslapd-maxbersize, nsslapd-conntablesize) and deploying the server in a cgroup with memory constraints. Patch status is confirmed fixed in updated Red Hat packages.