CVE-2026-86344

Name of the Vulnerable Software and Affected Versions 389-ds-base (affected versions not specified)

Description An unauthenticated remote attacker can cause a denial of service by sending a complete LDAP operation followed by the initial bytes of an incomplete LDAPMessage on the same connection. This sequence forces the server to assign the connection to a second worker thread before the first worker's result is flushed. The second worker then blocks until the nsslapd-ioblocktimeout is reached while holding the connection mutex, which prevents the delivery of the completed operation's result. By repeating this process across a small number of connections relative to the configured worker-thread pool size, an attacker can exhaust the entire pool under default configurations, denying service to all clients, including anonymous and authenticated users via plaintext and TLS.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.