CVE-2026-86344: 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.
Affected Software
Event History
Frequently Asked Questions
Which deployments and clients are affected?
The issue affects servers using the default worker-thread-pool configuration. Once the pool is exhausted, all clients are denied service, including anonymous and authenticated clients over both plaintext and TLS connections.
What does an attacker need to do to trigger the denial of service?
An unauthenticated remote attacker needs to send a complete LDAP operation followed by the initial bytes of an incomplete LDAPMessage on the same connection. Repeating this on a small number of maintained connections proportional to the configured worker-thread pool size can exhaust all worker threads.
How long does the disruption last?
The denial of service persists for as long as the attacker keeps the malicious connections open. The blocked worker waits until the configured nsslapd-ioblocktimeout while holding the connection mutex.