389 Directory Server: Denial of service via worker-thread pool exhaustion
Summary
An unauthenticated remote attacker can exhaust the worker-thread pool of the 389 Directory Server (389-ds-base) LDAP server. By sending a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, the attacker blocks worker threads using only a small number of connections. This works against the default configuration and denies service to all clients, anonymous and authenticated, over plaintext and TLS, for as long as the attacker keeps the connections open. Confidentiality and integrity of directory data are not affected, and service recovers within about a second after the connections are released.
Affected
- Red Hat Directory Server 11, 12 and 13 (default: affected)
- Red Hat Enterprise Linux 8, 9 and 10 (default: affected)
- Red Hat Enterprise Linux 6 and 7 (default: unknown)
Fixed in
Unknown. No fixed package version was confirmed in the sources reviewed. Check the Red Hat CVE page for the fixed 389-ds-base build.
Workaround
- Limit the number of concurrent connections per source IP address in front of the LDAP listener, for example with a firewall, load balancer or fail2ban.
- Upgrading to a fixed package is the only complete resolution.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- Exploitation requires only a few simultaneous connections and no authentication.
Our recommendation
- Check whether 389-ds-base or Red Hat Directory Server is in use and identify the installed version.
- Restrict LDAP access to trusted networks and limit concurrent connections per source IP.
- Install the fixed package from the vendor as soon as it is available and monitor LDAP connection counts and availability.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page CVE-2026-86344 access.redhat.com
- Red Hat Bugzilla 2529329 bugzilla.redhat.com
- OSV Debian CVE-2026-86344 osv.dev
- Red Pacet Security CVE alert CVE-2026-86344 www.redpacketsecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 23:35.
Original description (NVD)
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.