7.5

CVE-2021-4091: port389 389-ds-base Double Free

CVSS: 7.5v3.1HighModified
AliasesMGASA-2022-0106RHSA-2022:0628RHSA-2022:0889
Published 18-02-2022Last modified 03-11-2025
Open JSON

Vulnerability summary

CVE-2021-4091 is a high (CVSS 7.5) Double Free vulnerability in port389 389-ds-base. EPSS estimates a 2.01% chance of exploitation in the next 30 days, higher than 80.5% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
2.01%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 5
DLA-3399-1DLA-4021-1RHSA-2022:0952SUSE-SU-2022:2081-1SUSE-SU-2022:2105-1SUSE-SU-2022:2109-1

Timeline

  1. 18-02-2022
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

2.01%

Chance of exploitation in the next 30 days

Percentile

81%

Versus all other CVEs

30-day change

0.00 pp

From 2.01% on 18-09-2026

18-09-202618-10-2026
EPSS score
2.01%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat18 products
Debian1 product
  • 389-ds-base< 2.0.15-1
Mageia1 product
  • 389-ds-base< 1.4.0.26-8.2.mga8
Port3891 product
Ubuntu1 product
  • 389-ds-baseAll versions (No fix recorded)

5 vendors · 22 products

References

23 links
Show all 23 references