{"id":"CVE-2024-5953","title":"389-ds-base: malformed userpassword hash may cause denial of service","summary":"A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.","severity":"medium","cvss":5.7,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-1288"],"vendor":"Red Hat","product":"389-ds-base","affected":["389-ds-base (all versions)","redhat-ds:11 (all versions)","redhat-ds:11 (all versions)","redhat-ds:11 (all versions)","redhat-ds:12 (all versions)","redhat-ds:12 (all versions)","389-ds-base (all versions)","389-ds:1.4 (all versions)","389-ds:1.4 (all versions)","389-ds-base (all versions)","389-ds-base (all versions)","389-ds-base","389-ds-base"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-06-18T13:32:13.391886Z"},"published":"2024-06-18","updated":"2026-11-07","sourceUpdated":"2026-11-07T11:32:02.079Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-5953","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:4633","label":"RHSA-2024:4633"},{"url":"https://access.redhat.com/errata/RHSA-2024:4997","label":"RHSA-2024:4997"},{"url":"https://access.redhat.com/errata/RHSA-2024:5192","label":"RHSA-2024:5192"},{"url":"https://access.redhat.com/errata/RHSA-2024:5690","label":"RHSA-2024:5690"},{"url":"https://access.redhat.com/errata/RHSA-2024:6153","label":"RHSA-2024:6153"},{"url":"https://access.redhat.com/errata/RHSA-2024:6568","label":"RHSA-2024:6568"},{"url":"https://access.redhat.com/errata/RHSA-2024:6569","label":"RHSA-2024:6569"},{"url":"https://access.redhat.com/errata/RHSA-2024:6576","label":"RHSA-2024:6576"},{"url":"https://access.redhat.com/errata/RHSA-2024:7458","label":"RHSA-2024:7458"},{"url":"https://access.redhat.com/errata/RHSA-2025:1632","label":"RHSA-2025:1632"},{"url":"https://access.redhat.com/security/cve/CVE-2024-5953"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2292104","label":"RHBZ#2292104"}],"tags":["cve.org"],"epss":0.00578,"epssPercentile":0.47839,"ingestedAt":"2026-11-07T12:16:41.115Z","slug":"CVE-2024-5953","body":"## Overview\n\nA denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.\n\n## Affected\n\n- `389-ds-base (all versions)`\n- `redhat-ds:11 (all versions)`\n- `redhat-ds:11 (all versions)`\n- `redhat-ds:11 (all versions)`\n- `redhat-ds:12 (all versions)`\n- `redhat-ds:12 (all versions)`\n- `389-ds-base (all versions)`\n- `389-ds:1.4 (all versions)`\n- `389-ds:1.4 (all versions)`\n- `389-ds-base (all versions)`\n- `389-ds-base (all versions)`\n- `389-ds-base`\n- `389-ds-base`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nMitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":31.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}