CVE-2026-86344 - 389-ds-base Vulnerability Report
CVE-2026-86344 - 389-ds-base Vulnerability Report
A new high-severity vulnerability, identified as CVE-2026-86344, has been reported in 389-ds-base. This flaw, described as “unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue,” carries a HIGH CVSS 3.1 score of 7.5. 🚨
Vulnerability Details
Specifically, a flaw was found in 389-ds-base where an unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection. This action causes the server to hand that connection to a second worker thread before the first worker’s result is flushed. The second worker then blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation’s result.
Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration. This denial of service impacts all clients—anonymous and authenticated, plaintext and TLS—for as long as the attacker maintains the connections.
Impact
The vulnerability affects products from one vendor, with a total of 4 products listed as impacted. CVE-2026-86344 has a CVSS 3.1 score of 7.5, rated as HIGH severity, with an Exploitability Score of 3.9 and an Impact Score of 3.6, according to MITRE-CVE and secalert@redhat.com. This CVE is associated with CWE-400: Uncontrolled Resource Consumption. Furthermore, associated Common Attack Pattern Enumeration and Classification (CAPEC) patterns include:
- CAPEC-147: XML Ping of the Death
- CAPEC-227: Sustained Client Engagement
- CAPEC-492: Regular Expression Exponential Blowup
Recommendations
To address this vulnerability, users should update 389-ds-base to a patched version to prevent denial of service by fixing connection handling. It is also recommended that users apply configuration changes as recommended by the vendor and monitor the server for denial of service conditions.
For further information, see the relevant links:
To read the complete article, see: CVE-2026-86344 Details