{"id":"CVE-2026-86344","published":"2026-10-01T22:17:05.590","lastModified":"2026-10-02T19:16:42.620","description":"A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-86344","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529329","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows unauthenticated attackers to exhaust the server's worker thread pool by sending specially crafted LDAP operations that cause the server to switch between threads before completing responses, leading to a denial of service for all clients.","exploitability":"Exploitation is straightforward requiring only an unauthenticated LDAP connection with minimal setup, though it requires maintaining multiple connections proportional to the worker thread pool size.","blast_radius":"The attack can deny service to all LDAP clients including anonymous and authenticated users across both plaintext and TLS connections, potentially affecting critical directory services and applications relying on 389-ds.","remediation":"Upgrade to 389-ds-base version 2.590 or later to receive the fix for this thread pool exhaustion vulnerability.","detection":"Monitor for repeated connection establishment patterns and observe if the server's worker thread pool becomes exhausted, which may manifest as increased connection timeouts or degraded LDAP service performance.","tags":["ldap","denial-of-service","directory-service","thread-pool"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:05:19.681Z"}}