CVE-2026-86344

Received Received - Intake

Denial of Service in 389 Directory Server

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: redhat-SADP

Description

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-01

Generated

2026-10-02

AI Q&A

2026-10-02

EPSS Evaluated

N/A

NVD

CVE-2026-86344

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	389-ds-base	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial-of-service flaw in 389-ds-base, an LDAP server. An attacker can exploit it by sending a complete LDAP operation followed by partial data on the same connection. This causes the server to assign the connection to a second worker thread before the first thread finishes processing. The second thread blocks while holding a mutex, preventing other operations from completing. Repeating this across a few connections exhausts the worker thread pool, denying service to all clients.

Detection Guidance

This vulnerability can be detected by monitoring for unusually high connection counts or blocked worker threads in 389 Directory Server. Check logs for repeated incomplete LDAP operations or connection timeouts. Use netstat or ss to inspect active connections and thread states.

Impact Analysis

If you use 389-ds-base, this vulnerability could cause your LDAP server to become unresponsive or crash, preventing users from authenticating or accessing directory services. It may lead to downtime, loss of productivity, and potential data access issues for all clients, including both anonymous and authenticated users.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions that violate availability requirements in GDPR, HIPAA, or other regulations. Downtime may lead to unauthorized access attempts or failure to provide timely data access, potentially resulting in non-compliance with data protection and security standards.

Mitigation Strategies

Immediately update 389-ds-base to the latest patched version. Temporarily reduce the worker-thread pool size or increase nsslapd-ioblocktimeout to limit impact. Block suspicious LDAP traffic at the firewall until patched.

Hi! I’m here to help you understand CVE-2026-86344. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70