CVE-2020-36228: OpenLDAP slapd integer underflow crashes server via Certificate List Exact Assertion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote, unauthenticated denial of service with a high CVSS score (7.5) and very high EPSS probability, though no KEV listing or documented exploitation.

What it is

OpenLDAP before 2.4.57 contains an integer underflow in slapd's Certificate List Exact Assertion processing. A crafted request triggers the underflow and crashes the daemon, causing denial of service. The flaw is remotely reachable without authentication, so any exposed LDAP service is at risk of disruption.

Impact

An attacker can crash slapd, taking down the directory service and any applications that depend on it for authentication or lookups. No data confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

Reached over the network via the LDAP service (CVSS vector AV:N/AC:L/PR:N/UI:N), requiring no authentication and no user interaction. Any host running an affected slapd build with network exposure is a candidate target.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high (0.842, ~99.7th percentile), indicating elevated predicted exploitation likelihood. References are patch, vendor advisory and third-party advisory only; no public exploit is cited in the record.

What to do

• Upgrade OpenLDAP to 2.4.57 or later, or apply the vendor patch commit 91dccd25c347733b365adc74cb07d074512ed5ad.
• Apply distribution backports (Debian DSA-4845, Apple security updates HT212529/HT212530/HT212531, NetApp advisory) where the base package cannot be replaced.
• Restrict network access to slapd to trusted clients and management networks; do not expose LDAP directly to the internet.
• Run slapd under a supervisor or service manager that restarts it automatically, and monitor for repeated crash-restart cycles.
• If patching is delayed, consider fronting slapd with a proxy or filter that rejects malformed Certificate List Exact Assertion requests.

Detection

• Monitor slapd logs and systemd/journald for unexpected process termination, segfault or core dumps and correlate with inbound LDAP connections.
• Alert on repeated slapd restarts or availability gaps in LDAP health checks.
• Inspect network traffic for LDAP requests containing Certificate List Exact Assertion syntax from untrusted sources.
• Track EPSS and vendor advisories for this CVE and confirm affected hosts are patched.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.