CVE-2026-86344

Summary

The flaw allows unauthenticated attackers to exhaust the server's worker thread pool by sending specially crafted LDAP operations that cause the server to switch between threads before completing responses, leading to a denial of service for all clients.

Exploitability

Exploitation is straightforward requiring only an unauthenticated LDAP connection with minimal setup, though it requires maintaining multiple connections proportional to the worker thread pool size.

Blast radius

The attack can deny service to all LDAP clients including anonymous and authenticated users across both plaintext and TLS connections, potentially affecting critical directory services and applications relying on 389-ds.

Detection

Monitor for repeated connection establishment patterns and observe if the server's worker thread pool becomes exhausted, which may manifest as increased connection timeouts or degraded LDAP service performance.

Prioritized remediation

Upgrade to 389-ds-base version 2.590 or later to receive the fix for this thread pool exhaustion vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.