A flaw was found in 389-ds-base. (CVE-2026-86344)

CVE-2026-86344 describes a flaw in 389-ds-base where an unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection. This causes the server to hand the connection to a second worker thread before the first worker's result is flushed. The second worker then blocks until the configured nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. By repeating this attack across a small number of connections proportional to the worker-thread pool size, the attacker exhausts the entire pool under default configuration, resulting in denial of service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the connections are maintained.

The vulnerability allows unauthenticated remote attackers to cause a denial of service by exhausting the server's worker-thread pool. This affects availability, preventing all clients from receiving service while the attack is ongoing. There is no impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure of the LDAP service to untrusted networks or implementing network-level protections to detect and block suspicious connection patterns that could trigger this denial-of-service condition.