DEBIAN-CVE-2026-86344
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-86344
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-86344.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-86344
- Upstream
- CVE-2026-86344
- Published
- 2026-10-01T22:17:05Z
- Modified
- 2026-10-02T09:00:12Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.
- References
Affected packages
Debian:12 / 389-ds-base
Package
- Name
- 389-ds-base
- Purl
- pkg:deb/debian/389-ds-base?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:13 / 389-ds-base
Package
- Name
- 389-ds-base
- Purl
- pkg:deb/debian/389-ds-base?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected