CVE Alert: CVE-2026-86344 – Red Hat

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker’s result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation’s result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.

**Risk verdict:** Elevated service-availability risk; prioritise systems reachable by untrusted networks, while active exploitation status cannot be established from the supplied data.

**Why this matters:** A remote attacker could deny directory services to both anonymous and authenticated clients, disrupting applications and identity workflows that depend on LDAP. No KEV, SSVC, PoC or EPSS data is supplied, so exploitation likelihood and campaign activity remain uncertain.

**Most likely attack path:** An unauthenticated attacker can reach the LDAP listener over the network, without user interaction or special conditions, and use a small number of concurrent connections to tie up server workers. The impact remains within the affected service’s security scope; this is a denial-of-service path, not evidence of direct lateral movement.

**Who is most exposed:** Internet-accessible directory instances are at greatest risk; internally reachable servers may also be exposed to compromised hosts or untrusted network segments. Prioritise instances serving authentication, application lookups or other critical identity functions.

Alert on bursts of concurrent, long-lived LDAP connections from one source.

Monitor worker-pool exhaustion, blocked connection handling and I/O timeout events.

Track sharp rises in LDAP latency, failed requests or client reconnects.

Correlate these signals with source IPs and edge connection logs.

Mitigation and prioritisation:

Apply the vendor’s fixed package promptly; verify the installed build against its security advisory.

Until patched, limit concurrent LDAP connections per source IP at a firewall or load balancer.

Keep LDAP listeners off the public internet where possible; restrict access to trusted networks.

Test controls and updates against directory-dependent services, with rollback plans for production changes.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.