CVE-2026-86344: 389 Directory Server DoS Vulnerability

CVE-2026-86344 Overview

CVE-2026-86344 is a denial of service vulnerability in 389-ds-base, the directory server used in Red Hat Directory Server and FreeIPA deployments. An unauthenticated remote attacker can exhaust the server's worker thread pool by sending partial Lightweight Directory Access Protocol (LDAP) messages across a small number of connections. The flaw is categorized under Resource Exhaustion [CWE-400] and affects all client traffic, including anonymous, authenticated, plaintext, and TLS sessions. The attack requires no credentials and only modest network resources proportional to the configured thread pool size.

Critical Impact
Unauthenticated attackers can block all LDAP service to legitimate clients for the duration of the attack by exploiting worker thread handoff logic.

Affected Products

389 Directory Server (389-ds-base)
Red Hat Directory Server deployments using affected 389-ds-base builds
Downstream products embedding 389-ds-base, including FreeIPA and Identity Management (IdM)

Discovery Timeline

2026-10-01 - CVE-2026-86344 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-86344

Vulnerability Analysis

The vulnerability lives in the connection-handling and worker-dispatch path of 389-ds-base. The server reads LDAP protocol data unit (PDU) data from a connection, dispatches each complete operation to a worker thread, and expects the connection mutex to serialize access to that connection's output. An attacker sends a complete LDAP operation followed by the leading bytes of a second, incomplete LDAPMessage on the same TCP session. The server then hands the connection to a second worker thread before the first worker has flushed its response. The second worker blocks on the incomplete read while holding the connection mutex, which prevents the first worker from writing its result. The connection remains stuck until the nsslapd-ioblocktimeout interval expires.

Root Cause

The root cause is a worker-dispatch logic error that releases a connection to a new worker before the previous worker has completed its I/O. Combined with mutex-held blocking reads governed by nsslapd-ioblocktimeout, each attacker-controlled connection consumes two worker slots for the full timeout window. Because the default worker pool size is bounded, a small number of malicious connections drain the entire pool.

Attack Vector

The attack is remote, network-based, and requires no authentication or user interaction. An attacker opens a handful of TCP sessions to port 389 or 636 and, on each, sends one complete LDAP operation followed by a partial LDAPMessage header. As the number of malicious connections approaches the configured worker-thread pool size, the server stops servicing new or in-flight requests from legitimate clients. The denial of service persists for as long as the attacker holds the connections open and continues the partial-write pattern.

// No verified proof-of-concept code is published for CVE-2026-86344.
// See the Red Hat advisory for protocol-level technical details.

Detection Methods for CVE-2026-86344

Indicators of Compromise

Multiple concurrent LDAP connections that remain open with no completed operations and trigger nsslapd-ioblocktimeout disconnects.
Access log entries showing operations accepted but never followed by a corresponding RESULT line for the same connection ID.
Error log entries referencing ioblocktimeout closures clustered in a short time window across different source addresses.

Detection Strategies

Monitor the ratio of in-flight LDAP operations to completed RESULT entries per connection in the access log and alert on sustained imbalance.
Baseline the typical count of worker threads in waiting state via cn=monitor and alert when active workers approach the configured pool size.
Correlate TCP sessions to ports 389, 636, and 3268 that stay open with minimal bytes transferred against the configured I/O block timeout.

Monitoring Recommendations

Enable verbose connection-table logging and query cn=snmp,cn=monitor for currentconnections and opsinitiated metrics to spot stalled workers.
Forward 389-ds-base logs to a centralized analytics tier for pattern detection across source IPs.
Alert on repeated connections from the same source that trigger ioblocktimeout closures without producing a bind or search result.

How to Mitigate CVE-2026-86344

Immediate Actions Required

Apply vendor patches for 389-ds-base as soon as they are available from your Linux distribution or Red Hat.
Restrict LDAP exposure at the network edge so only trusted management and application subnets can reach ports 389 and 636.
Front the directory service with a connection-aware proxy or load balancer that enforces per-source connection limits and idle timeouts.

Patch Information

Refer to the Red Hat CVE-2026-86344 Advisory and Red Hat Bug Report #2529329 for fixed package versions and errata applicable to each supported Red Hat Enterprise Linux and Red Hat Directory Server release. Rebuild or redeploy derivative products that embed 389-ds-base, including FreeIPA and Identity Management, after patching the base package.

Workarounds

Reduce nsslapd-ioblocktimeout to shorten the window during which blocked workers hold the connection mutex, accepting the tradeoff of stricter client timing requirements.
Increase nsslapd-threadnumber to raise the attack cost, while recognizing this does not fully remediate the flaw.
Enforce per-source IP connection limits with iptables, nftables, or an LDAP-aware proxy to cap concurrent sessions from any single client.
Require TLS and client certificate authentication at a proxy tier so unauthenticated attackers cannot reach the vulnerable dispatch path.

bash

# Example per-source connection cap using nftables (adjust limit for environment)
nft add rule inet filter input tcp dport { 389, 636 } \
    ct state new meter ldap_conns { ip saddr limit rate 20/second } accept

# Example 389-ds-base configuration tightening (apply via ldapmodify)
# dn: cn=config
# changetype: modify
# replace: nsslapd-ioblocktimeout
# nsslapd-ioblocktimeout: 10000