Hi!
Just two points: If someone overloads a server causing DoS, then it's most likely not a security bug, but if someone could send some magic packet that would permanentlyx block an LDAP service thread, that would definitely be a security bug (IMHO), See one of the latest OpenSSL bugs (HollowByte, AFAIR).
Even companies not exposing their services to the public Internet are worried with DoS attacks, assuming that even their staff could be a potential adversary. Paranoid, maybe, but real.
Kind regards, Ulrich Windl
-----Original Message----- From: Ondřej Kuzník ondra@mistotebe.net Sent: Thursday, August 13, 2026 11:58 AM To: Brett A C Sheffield bacs@librecast.net Cc: OpenLDAP Technical openldap-technical@openldap.org Subject: [EXT] Re: [EXT] Security policy
Sicherheits-Hinweis: Diese E-Mail wurde von einer Person außerhalb des UKR gesendet. Seien Sie vorsichtig vor gefälschten Absendern, wenn Sie auf Links klicken, Anhänge öffnen oder weitere Aktionen ausführen, bevor Sie die Echtheit überprüft haben.
On Wed, Aug 12, 2026 at 03:15:52PM +0200, Brett A C Sheffield wrote:
On 2026-08-12 13:47, Howard Chu wrote:
Windl, Ulrich wrote:
So a DoS (Denial of Service) (e.g. by crashing the app from remote) is not
a security issue?
It does not allow remote code execution, privilege escalation, or privileged data exfiltration. So no, it is not a security issue.
That's an extraordinary position to take.
Remotely stopping code execution certainly gives the attacker something
they did
not have. Being able to remotely stop your systems from operating at will,
with
all the associated revenue loss and other impacts that may have may well
allow
an attacker to achieve their aims completely.
There are three impact categories for CVEs: confidentiality, integrity and availability. Are you really saying that ceding control over availability to an attacker is not a security issue? Being able to, say, shut down a rival phone company at will by killing their directory service seems like a security concern.
You asked for feedback, and I think you should reconsider this. A DoS is a security issue as far as most of the software industry is concerned. Less serious than RCE or LPE, but still of value to an attacker.
Hi Brett, I think you're confusing a critical bug and a vulnerability. An anonymous user being able to bring a server down is clearly the former but not latter, just like a hypothetical critical replication bug which clearly needs no CVE. We're not going to stop people from flagging it as private as mentioned in the preamble.
I agree that a tweak to clarify this is worth making. There might be a way to adjust the description that outlines that distinction yet does not suggest we encourage the perverse incentives of finding literally any bug and insisting it is a vulnerability which is really happening. If you have a suggestion, we're more than happy to adjust, that's the reason we proposed this here first before it lands on the website and maybe repo at some point.
Regards,
-- Ondřej Kuzník Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP