The PBKDF2-SHA256 password storage plugin in 389 Directory Server extracts the iteration count from stored password hashes without an upper bound check. An attacker with Directory Manager privileges can plant a crafted {PBKDF2_SHA256} hash with extreme iteration counts (e.g. 0x7FFFFFFF). Any subsequent LDAP BIND as the poisoned account triggers unbounded CPU consumption, hanging a worker thread for hours and enabling persistent denial of service.

Both the C plugin (pbkdf2_pwd.c) and Rust plugin (pwdchan/lib.rs) are affected. Distinct from CVE-2024-5953 which added hash length check but not iteration cap.

Introduced in 389-ds-base 1.3.6 (commit 542287ce7, Ticket 397). PoC confirmed on Fedora 42 production binary.