CVE-2008-2952

liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service ...

5.0 MediumPublic exploitFix available

liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error.

Exploit likelihood

13.2%Up 0.6 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error.

Record: CVE-2008-2952
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-399
Updated: 2026-11-02

CVE List No score

liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error.

Record: CVE-2008-2952
Updated: 2026-11-02

EUVDEUVD-2008-2942 No score

liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error.

Record: EUVD-2008-2942
Updated: 2026-11-03

GitHub AdvisoriesGHSA-mgjr-3gvp-wpc2 No score

liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service ...

liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error.

Record: GHSA-mgjr-3gvp-wpc2
Updated: 2026-11-02

OSVBELL-CVE-2008-2952 5.0

CVE-2008-2952 does not affect BellSoft software

Record: BELL-CVE-2008-2952
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated: 2026-11-02

OSV No score

liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error.

Record: CVE-2008-2952
Updated: 2026-11-02

OSVDEBIAN-CVE-2008-2952 No score

liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error.

Record: DEBIAN-CVE-2008-2952
Updated: 2026-11-02

Affected products

openldap

Affected packages

Affected packages
Package	Affected	Fixed
`openldap` Debian:12	before 2.4.10-3	2.4.10-3
`openldap` Debian:13	before 2.4.10-3	2.4.10-3
`openldap` Debian:14	before 2.4.10-3	2.4.10-3
`openldap2.3` Debian:4.0	before 2.3.30-5+etch2, plus listed versions 2.3.30-52.3.30-5+etch1	2.3.30-5+etch2
`openldap` Debian:5.0	before 2.4.10-2+lenny1	2.4.10-2+lenny1
`compat-openldap` Red Hat:enterprise_linux:4::as	before 0:2.1.30-8.el4_6.5	0:2.1.30-8.el4_6.5
`openldap` Red Hat:enterprise_linux:4::as	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-clients` Red Hat:enterprise_linux:4::as	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-debuginfo` Red Hat:enterprise_linux:4::as	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-devel` Red Hat:enterprise_linux:4::as	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5

Show 39 moreShow less

Affected packages
Package	Affected	Fixed
`openldap-servers` Red Hat:enterprise_linux:4::as	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-servers-sql` Red Hat:enterprise_linux:4::as	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`compat-openldap` Red Hat:enterprise_linux:4::desktop	before 0:2.1.30-8.el4_6.5	0:2.1.30-8.el4_6.5
`openldap` Red Hat:enterprise_linux:4::desktop	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-clients` Red Hat:enterprise_linux:4::desktop	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-debuginfo` Red Hat:enterprise_linux:4::desktop	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-devel` Red Hat:enterprise_linux:4::desktop	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-servers` Red Hat:enterprise_linux:4::desktop	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-servers-sql` Red Hat:enterprise_linux:4::desktop	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`compat-openldap` Red Hat:enterprise_linux:4::es	before 0:2.1.30-8.el4_6.5	0:2.1.30-8.el4_6.5
`openldap` Red Hat:enterprise_linux:4::es	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-clients` Red Hat:enterprise_linux:4::es	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-debuginfo` Red Hat:enterprise_linux:4::es	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-devel` Red Hat:enterprise_linux:4::es	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-servers` Red Hat:enterprise_linux:4::es	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-servers-sql` Red Hat:enterprise_linux:4::es	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`compat-openldap` Red Hat:enterprise_linux:4::ws	before 0:2.1.30-8.el4_6.5	0:2.1.30-8.el4_6.5
`openldap` Red Hat:enterprise_linux:4::ws	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-clients` Red Hat:enterprise_linux:4::ws	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-debuginfo` Red Hat:enterprise_linux:4::ws	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-devel` Red Hat:enterprise_linux:4::ws	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-servers` Red Hat:enterprise_linux:4::ws	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap-servers-sql` Red Hat:enterprise_linux:4::ws	before 0:2.2.13-8.el4_6.5	0:2.2.13-8.el4_6.5
`openldap` Red Hat:enterprise_linux:5::client_workstation	before 0:2.3.27-8.el5_2.4	0:2.3.27-8.el5_2.4
`openldap-debuginfo` Red Hat:enterprise_linux:5::client_workstation	before 0:2.3.27-8.el5_2.4	0:2.3.27-8.el5_2.4
`openldap-devel` Red Hat:enterprise_linux:5::client_workstation	before 0:2.3.27-8.el5_2.4	0:2.3.27-8.el5_2.4
`openldap-servers` Red Hat:enterprise_linux:5::client_workstation	before 0:2.3.27-8.el5_2.4	0:2.3.27-8.el5_2.4
`openldap-servers-sql` Red Hat:enterprise_linux:5::client_workstation	before 0:2.3.27-8.el5_2.4	0:2.3.27-8.el5_2.4
`compat-openldap` Red Hat:enterprise_linux:5::client	before 0:2.3.27_2.2.29-8.el5_2.4	0:2.3.27_2.2.29-8.el5_2.4
`openldap` Red Hat:enterprise_linux:5::client	before 0:2.3.27-8.el5_2.4	0:2.3.27-8.el5_2.4
`openldap-clients` Red Hat:enterprise_linux:5::client	before 0:2.3.27-8.el5_2.4	0:2.3.27-8.el5_2.4
`openldap-debuginfo` Red Hat:enterprise_linux:5::client	before 0:2.3.27-8.el5_2.4	0:2.3.27-8.el5_2.4
`compat-openldap` Red Hat:enterprise_linux:5::server	before 0:2.3.27_2.2.29-8.el5_2.4	0:2.3.27_2.2.29-8.el5_2.4
`openldap` Red Hat:enterprise_linux:5::server	before 0:2.3.27-8.el5_2.4	0:2.3.27-8.el5_2.4
`openldap-clients` Red Hat:enterprise_linux:5::server	before 0:2.3.27-8.el5_2.4	0:2.3.27-8.el5_2.4
`openldap-debuginfo` Red Hat:enterprise_linux:5::server	before 0:2.3.27-8.el5_2.4	0:2.3.27-8.el5_2.4
`openldap-devel` Red Hat:enterprise_linux:5::server	before 0:2.3.27-8.el5_2.4	0:2.3.27-8.el5_2.4
`openldap-servers` Red Hat:enterprise_linux:5::server	before 0:2.3.27-8.el5_2.4	0:2.3.27-8.el5_2.4
`openldap-servers-sql` Red Hat:enterprise_linux:5::server	before 0:2.3.27-8.el5_2.4	0:2.3.27-8.el5_2.4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	OpenLDAP 2.3.41 - BER Decoding Remote Denial of Service	2008-06-30

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-2952 is a medium vulnerability (CVSS 5.0) in Openldap, published July 1, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.2%, the 96th percentile. Fixed in openldap 2.4.10-3.

References

Show 36 moreShow less