Brett A C Sheffield wrote:
On 2026-08-12 13:47, Howard Chu wrote:
Windl, Ulrich wrote:
So a DoS (Denial of Service) (e.g. by crashing the app from remote) is not a security issue?
It does not allow remote code execution, privilege escalation, or privileged data exfiltration. So no, it is not a security issue.
That's an extraordinary position to take.
Remotely stopping code execution certainly gives the attacker something they did not have. Being able to remotely stop your systems from operating at will, with all the associated revenue loss and other impacts that may have may well allow an attacker to achieve their aims completely.
There are three impact categories for CVEs: confidentiality, integrity and availability. Are you really saying that ceding control over availability to an attacker is not a security issue? Being able to, say, shut down a rival phone company at will by killing their directory service seems like a security concern.
Realistically, no company exposes their directory infrastructure to the public Internet. There have been many DoS's via leftover asserts in the code thru the years, but none of these have ever been associated with reports of actual attacks.
You asked for feedback, and I think you should reconsider this. A DoS is a security issue as far as most of the software industry is concerned. Less serious than RCE or LPE, but still of value to an attacker.
Are we talking about the same software industry that thinks LLMs are the coolest thing ever? Arguments based on what the rest of the industry deems important aren't really convincing.
This has been the OpenLDAP Project policy since the beginning, in 1998. We care about data integrity and privacy first and foremost. You can't break the privacy of a downed server.