CVE-2020-36227: OpenLDAP slapd infinite loop in cancel_extop Cancel operation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable denial of service with a high EPSS score and available patch, though no KEV listing or confirmed in-the-wild exploitation is documented.

What it is

OpenLDAP before 2.4.57 contains an infinite loop in slapd triggered by the cancel_extop Cancel operation, causing denial of service. The flaw is a CWE-835 loop-with-unreachable-exit-condition issue in the LDAP server daemon. It matters because a single crafted request can hang the directory service, affecting authentication and directory lookups for all dependent systems.

Impact

An attacker can drive slapd into an infinite loop, consuming CPU and making the LDAP service unresponsive, denying directory access to legitimate users and applications. No data confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

Reachable over the network via the LDAP protocol (CVSS vector AV:N/AC:L/PR:N/UI:N), so no authentication or user interaction is required per the vector. The attack targets the cancel_extop Cancel extended operation handled by slapd.

Exploitation

Not listed in CISA KEV and no ransomware usage documented, but EPSS is 0.77738 (99.5th percentile), indicating a high modeled likelihood of exploitation activity. References include vendor advisories and a patch commit, but no public exploit code is cited in the record.

What to do

• Upgrade OpenLDAP to 2.4.57 or later, which contains the fix commit 9d0e8485f3113505743baabf1167e01e4558ccf5.
• Apply vendor updates for downstream distributions and products (Debian DSA-4845, Apple HT212529/HT212530/HT212531, NetApp advisory).
• Restrict network access to slapd LDAP ports to trusted clients and management networks where feasible.
• Monitor slapd CPU and process health so a hung daemon is detected and restarted quickly.
• If patching is delayed, consider rate limiting or filtering the cancel extended operation at the network or proxy layer.

Detection

• Alert on slapd processes sustaining high CPU with no corresponding request throughput, indicating a possible infinite loop.
• Monitor for repeated or malformed cancel_extop Cancel extended operation requests in LDAP logs or network traffic.
• Track slapd availability and restart events; correlate with LDAP client connection failures.
• Watch for LDAP traffic from unexpected or untrusted source addresses targeting the directory service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.