As per upstream advisory:

LDAP is encoded as ASN.1, and LDAP filters are defined recursively as
   Filter ::= CHOICE {
                and             [0] SET OF Filter,
                or              [1] SET OF Filter,
                not             [2] Filter,
		
This recursion is mirrored in Samba's recursive decent parser, which consumes around 600 bytes of stack per filter sent by the client.

In Samba, LDAP packets are parsed pre-authentication.

As an example on Linux x86_64, a LDAP search expression of (|(|(x=y))) will consume over 1k of stack (600 bytes or so per OR).  Therefore, even a fairly small, un-authenticated LDAP packet can cause the server to fault with SIGSEGV as the stack reaches the OS-imposed limit (8MB in this case).

If the network architecture allows a CLDAP packet (to UDP port 389) of over 13,000 bytes (the maximum UDP packet size is 65,535) this would also fit enough ASN.1 to crash the CLDAP server.

Samba 4.11 and later use the 'prefork' process model by default for LDAP, and all versions use single process for CLDAP.

This shares one process between multiple network clients.  By crashing one worker, legitimate service is disrupted to other clients.  The process is restarted in all supported versions, but with a back-off.