CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.
- Record
CVE-2026-86344- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2026-91076
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.
- Record
EUVD-2026-91076- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-62jf-8m49-534w
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP...
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.
- Record
GHSA-62jf-8m49-534w- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.
- Record
CVE-2026-86344- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-86344
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.
- Record
DEBIAN-CVE-2026-86344- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
OSVUBUNTU-CVE-2026-86344
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.
- Record
UBUNTU-CVE-2026-86344- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVAZL-107951 No score
CVE-2026-86344 affecting package 389-ds-base 3.1.1-12
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.
- Record
AZL-107951- Updated
- 2026-11-05
OSVCLSA-2026-1792597970 No score
389-ds-base: Fix of 2 CVEs
- CVE-2026-86345: reject StartTLS when plaintext data is buffered after the request
- CVE-2026-86344: fix worker pool exhaustion via partial LDAP messages
- Record
CLSA-2026-1792597970- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12312-1 No score
389-ds-3.3.1+28b6d8afc-1.1 on GA media
These are all security issues fixed in the 389-ds-3.3.1+28b6d8afc-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12312-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4929-1 No score
Security update for 389-ds
This update for 389-ds fixes the following issues:
- CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133).
- CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remote code execution (bsc#1279864).
- CVE-2026-18453: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (bsc#1279572).
- CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication allows unauthenticated attackers to achieve privilege escalation to Directory Manager (bsc#1279865).
- CVE-2026-19843: unescaped LDAP DN in Cockpit 389 Console LDAP editor allows an LDAP user with delegated privileges to execute shell commands with root privileges on the directory server host (bsc#1279866).
- CVE-2026-76560: incorrect matching in the SELFDN ACI bind-rule evaluator allows an anonymous LDAP client to bypass access controls on directory entries containing empty SELFDN attributes (bsc#1279867).
- CVE-2026-86344: incomplete LDAP messages sent in rapid succession can cause worker thread exhaustion (bsc#1284028).
- CVE-2026-86345: smuggled plaintext commands sent alongside StartTLS requests can cause response forgery and authentication bypasses (bsc#1284034).
Update to version 2.2.11~git12.1e612cde2:
- Issue 7919 - CVE-2026-86344 - Fix worker pool exhaustion via partial LDAP messages (DoS)
- Issue 7921 - Fix StartTLS plaintext buffer handling (#7922) (#7947)
Update to version 2.2.11~git10.1f26fcebd:
- Issue 7912 - dsidm role create-filtered ignores --nsrolefilter and forces an interactive prompt (#7913)
- Issue 7908 - dsctl cockpit open-firewall --zone passes a malformed argument (#7909)
- Issue 7848 - Reject incomplete MD5 and GOST-YESCRYPT hashes (#7849)
- Issue 7837 - importing ldif with entry with long attribute name and subtype causes stack-buffer-overflow (#7838)
- Issue 6270 - heap-use-after-free with pwp dictionary path (#7791)
- Issue 7611 - PBKDF2 password verification should reject invalid iteration counts (#7632) (#7854)
- iadvisories/GHSA-rgxx-hcc4-x3h4 / heap-buffer-overflow in rdn_av_swap (#7826)
- Migrate pwdchan to base64 0.23 Engine API
- Update rust-dependencies
Update to version 2.2.11~git1.98ee3aac7:
- Issue 7757 - stack-buffer-overflow caused by slapi_attr_init_syntax() (#7759)
- Bump version to 2.2.11
- Security fix for CVE-2026-76560
- Security fix for CVE-2026-19843
- Security fix for CVE-2026-18922
- Security fix for CVE-2026-18453
- Security fix for CVE-2026-18355
- Issue 7595 - Remove the nightly dedup gate and fix dispatched test runs
- Fix expiration time check (#7718)
- Issue 7774 - Add backport action (#7775)
- Issue 7770 - Testimony failure in test_cleanruv_extop_security.py (#7771)
- Issue 1704 - Include stdbool.h in slapi headers on 2.4 (#7768)
- CVE-2026-11770 - Fix StartReplicationRequest auth gate response format
- Security fix for CVE-2026-11770
- Issue 3082 - Add test389.topologies compatibility shim for backports (#7725)
- Issue 7595 - Skip redundant CI runs to relieve the Actions queue (#7755)
- Issue 4701 - Fix UAF when excluding attrs from retro changelog (#7730)
- Issue 7723 - Range search returns an empty result when its start key is removed (#7724)
- Issue 7735 - Heap overflow when parsing objectclass superior (#7736)
- Issue 7733 - Typo about nsuniqueid in tombstone_to_conflict (#7734)
- Issue 7707 - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in join_supplier/hub/consumer (#7708)
- Record
SUSE-SU-2026:4929-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4932-1 No score
Security update for 389-ds
This update for 389-ds fixes the following issues:
- CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133).
- CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remote code execution (bsc#1279864).
- CVE-2026-18453: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (bsc#1279572).
- CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication allows unauthenticated attackers to achieve privilege escalation to Directory Manager (bsc#1279865).
- CVE-2026-19843: unescaped LDAP DN in Cockpit 389 Console LDAP editor allows an LDAP user with delegated privileges to execute shell commands with root privileges on the directory server host (bsc#1279866).
- CVE-2026-76560: incorrect matching in the SELFDN ACI bind-rule evaluator allows an anonymous LDAP client to bypass access controls on directory entries containing empty SELFDN attributes (bsc#1279867).
- CVE-2026-86344: incomplete LDAP messages sent in rapid succession can cause worker thread exhaustion (bsc#1284028).
- CVE-2026-86345: smuggled plaintext commands sent alongside StartTLS requests can cause response forgery and authentication bypasses (bsc#1284034).
Update to version 2.2.11~git12.1e612cde2:
- Issue 7919 - CVE-2026-86344 - Fix worker pool exhaustion via partial LDAP messages (DoS)
- Issue 7921 - Fix StartTLS plaintext buffer handling (#7922) (#7947)
Update to version 2.2.11~git10.1f26fcebd:
- Issue 7912 - dsidm role create-filtered ignores --nsrolefilter and forces an interactive prompt (#7913)
- Issue 7908 - dsctl cockpit open-firewall --zone passes a malformed argument (#7909)
- Issue 7848 - Reject incomplete MD5 and GOST-YESCRYPT hashes (#7849)
- Issue 7837 - importing ldif with entry with long attribute name and subtype causes stack-buffer-overflow (#7838)
- Issue 6270 - heap-use-after-free with pwp dictionary path (#7791)
- Issue 7611 - PBKDF2 password verification should reject invalid iteration counts (#7632) (#7854)
- iadvisories/GHSA-rgxx-hcc4-x3h4 / heap-buffer-overflow in rdn_av_swap (#7826)
- Migrate pwdchan to base64 0.23 Engine API
- Update rust-dependencies
Update to version 2.2.11~git1.98ee3aac7:
- Issue 7757 - stack-buffer-overflow caused by slapi_attr_init_syntax() (#7759)
- Bump version to 2.2.11
- Security fix for CVE-2026-76560
- Security fix for CVE-2026-19843
- Security fix for CVE-2026-18922
- Security fix for CVE-2026-18453
- Security fix for CVE-2026-18355
- Issue 7595 - Remove the nightly dedup gate and fix dispatched test runs
- Fix expiration time check (#7718)
- Issue 7774 - Add backport action (#7775)
- Issue 7770 - Testimony failure in test_cleanruv_extop_security.py (#7771)
- Issue 1704 - Include stdbool.h in slapi headers on 2.4 (#7768)
- CVE-2026-11770 - Fix StartReplicationRequest auth gate response format
- Security fix for CVE-2026-11770
- Issue 3082 - Add test389.topologies compatibility shim for backports (#7725)
- Issue 7595 - Skip redundant CI runs to relieve the Actions queue (#7755)
- Issue 4701 - Fix UAF when excluding attrs from retro changelog (#7730)
- Issue 7723 - Range search returns an empty result when its start key is removed (#7724)
- Issue 7735 - Heap overflow when parsing objectclass superior (#7736)
- Issue 7733 - Typo about nsuniqueid in tombstone_to_conflict (#7734)
- Issue 7707 - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in join_supplier/hub/consumer (#7708)
- Record
SUSE-SU-2026:4932-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
389-ds-baseAzure Linux:3 |
through 3.1.1-12 | None known |
389-ds-baseTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.2.4-5.el9_2.tuxcare.els11 | 2.2.4-5.el9_2.tuxcare.els11 |
389-ds-base-develTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.2.4-5.el9_2.tuxcare.els11 | 2.2.4-5.el9_2.tuxcare.els11 |
389-ds-base-libsTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.2.4-5.el9_2.tuxcare.els11 | 2.2.4-5.el9_2.tuxcare.els11 |
389-ds-base-snmpTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.2.4-5.el9_2.tuxcare.els11 | 2.2.4-5.el9_2.tuxcare.els11 |
python3-lib389TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 2.2.4-5.el9_2.tuxcare.els11 | 2.2.4-5.el9_2.tuxcare.els11 |
389-ds-baseDebian:12 |
All versions, plus listed versions 2.3.1+dfsg1-12.3.1+dfsg1-1+deb12u12.3.4+dfsg1-12.3.4+dfsg1-1.12.4.4+dfsg1-1 Show 13 moreShow less2.4.4+dfsg1-32.4.5+dfsg1-13.0.2+dfsg1-13.1.1+dfsg1-13.1.1+dfsg1-23.1.1+dfsg1-33.1.2+dfsg1-13.1.2+vendor1-13.1.2+vendor1-23.3.0-13.3.0-23.3.1-13.3.1-3 |
None known |
389-ds-baseDebian:13 |
All versions, plus listed versions 3.1.2+dfsg1-13.1.2+dfsg1-1+deb13u13.1.2+vendor1-13.1.2+vendor1-23.3.0-13.3.0-23.3.1-13.3.1-3 |
None known |
389-dsSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 8 CVEs |
before 2.2.11~git12.1e612cde2-150600.8.38.1 | 2.2.11~git12.1e612cde2-150600.8.38.1 |
389-dsSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 8 CVEs |
before 2.2.11~git12.1e612cde2-150600.8.38.1 | 2.2.11~git12.1e612cde2-150600.8.38.1 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
389-dsSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 8 CVEs |
before 2.2.11~git12.1e612cde2-150500.3.54.1 | 2.2.11~git12.1e612cde2-150500.3.54.1 |
389-dsSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 8 CVEs |
before 2.2.11~git12.1e612cde2-150500.3.54.1 | 2.2.11~git12.1e612cde2-150500.3.54.1 |
389-dsSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 8 CVEs |
before 2.2.11~git12.1e612cde2-150500.3.54.1 | 2.2.11~git12.1e612cde2-150500.3.54.1 |
389-dsSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 8 CVEs |
before 2.2.11~git12.1e612cde2-150500.3.54.1 | 2.2.11~git12.1e612cde2-150500.3.54.1 |
389-ds-baseUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.3.3.12-1build11.3.3.13-11.3.4.5-21.3.4.8-11.3.4.8-3 Show 4 moreShow less1.3.4.8-3ubuntu11.3.4.8-41.3.4.9-11.3.4.9-1ubuntu0.1~esm1 |
None known |
389-ds-baseUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.3.7.5-11.3.7.5-1build11.3.7.5-1build21.3.7.9-11.3.7.10-11.3.7.10-1ubuntu11.3.7.10-1ubuntu1+esm1 |
None known |
389-ds-baseUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.4.1.6-41.4.1.6-4build11.4.2.4-11.4.2.4-1build11.4.3.2-11.4.3.2-1build11.4.3.6-21.4.3.6-2ubuntu0.1~esm1 |
None known |
389-ds-baseUbuntu:22.04:LTS |
All versions, plus listed versions 1.4.4.11-2build11.4.4.11-2build21.4.4.17-12.0.11-22.0.14-12.0.15-12.0.15-1ubuntu2 |
None known |
389-ds-baseUbuntu:24.04:LTS |
All versions, plus listed versions 2.3.4+dfsg1-12.4.4+dfsg1-1ubuntu12.4.4+dfsg1-1ubuntu42.4.4+dfsg1-32.4.5+dfsg1-1 |
None known |
389-ds-baseUbuntu:26.10 |
All versions, plus listed versions 3.1.2+vendor1-23.1.2+vendor1-2build13.3.1-3 |
None known |
389-ds-baseUbuntu:26.04:LTS |
All versions, plus listed versions 3.1.2+dfsg1-13.1.2+vendor1-2 |
None known |
389-dsopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 3.3.1+28b6d8afc-1.1 | 3.3.1+28b6d8afc-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| facts | NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-86344 is a high vulnerability (CVSS 7.5) in Red Hat Directory Server 11, published October 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. No source names a fixed version.
References
access.redhat.com/security/cve/CVE-2026-86344
bugzilla.redhat.com/show_bug.cgi?id=2529329
nvd.nist.gov/vuln/detail/CVE-2026-86344
github.com/advisories/GHSA-62jf-8m49-534w
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792597970.html
Show 21 moreShow less
security-tracker.debian.org/tracker/CVE-2026-86344
suse.com/support/update/announcement/2026/suse-su-20264929-1
bugzilla.suse.com/1273133
ubuntu.com/security/CVE-2026-86344
cve.org/CVERecord?id=CVE-2026-86344