High

DEBIAN-CVE-2026-86344

Type: advisorySource: OSV1 source record

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.

Announced 1 Oct 2026Group revision 1

Original source ↗

DEBIAN-CVE-2026-86344

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-86344

389-ds-base

Source reference: /affected/0/package/name

Affected versions: 2.3.1+dfsg1-1
Source reference: /affected/0/versions
2.3.1+dfsg1-1+deb12u1
Source reference: /affected/0/versions
2.3.4+dfsg1-1
Source reference: /affected/0/versions
2.3.4+dfsg1-1.1
Source reference: /affected/0/versions
2.4.4+dfsg1-1
Source reference: /affected/0/versions
2.4.4+dfsg1-3
Source reference: /affected/0/versions
2.4.5+dfsg1-1
Source reference: /affected/0/versions
3.0.2+dfsg1-1
Source reference: /affected/0/versions
3.1.1+dfsg1-1
Source reference: /affected/0/versions
3.1.1+dfsg1-2
Source reference: /affected/0/versions
3.1.1+dfsg1-3
Source reference: /affected/0/versions
3.1.2+dfsg1-1
Source reference: /affected/0/versions
3.1.2+vendor1-1
Source reference: /affected/0/versions
3.1.2+vendor1-2
Source reference: /affected/0/versions
3.3.0-1
Source reference: /affected/0/versions
3.3.0-2
Source reference: /affected/0/versions
3.3.1-1
Source reference: /affected/0/versions
3.3.1-3
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

389-ds-base

Source reference: /affected/1/package/name

Affected versions: 3.1.2+dfsg1-1
Source reference: /affected/1/versions
3.1.2+dfsg1-1+deb13u1
Source reference: /affected/1/versions
3.1.2+vendor1-1
Source reference: /affected/1/versions
3.1.2+vendor1-2
Source reference: /affected/1/versions
3.3.0-1
Source reference: /affected/1/versions
3.3.0-2
Source reference: /affected/1/versions
3.3.1-1
Source reference: /affected/1/versions
3.3.1-3
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "389-ds-base",
      "purl": "pkg:deb/debian/389-ds-base?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "2.3.1+dfsg1-1",
      "2.3.1+dfsg1-1+deb12u1",
      "2.3.4+dfsg1-1",
      "2.3.4+dfsg1-1.1",
      "2.4.4+dfsg1-1",
      "2.4.4+dfsg1-3",
      "2.4.5+dfsg1-1",
      "3.0.2+dfsg1-1",
      "3.1.1+dfsg1-1",
      "3.1.1+dfsg1-2",
      "3.1.1+dfsg1-3",
      "3.1.2+dfsg1-1",
      "3.1.2+vendor1-1",
      "3.1.2+vendor1-2",
      "3.3.0-1",
      "3.3.0-2",
      "3.3.1-1",
      "3.3.1-3"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-86344.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "389-ds-base",
      "purl": "pkg:deb/debian/389-ds-base?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "3.1.2+dfsg1-1",
      "3.1.2+dfsg1-1+deb13u1",
      "3.1.2+vendor1-1",
      "3.1.2+vendor1-2",
      "3.3.0-1",
      "3.3.0-2",
      "3.3.1-1",
      "3.3.1-3"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-86344.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Related CVEs: CVE-2026-86344
Source reference: /upstream

Publisher severity

high

Source reference: /severity/0/score

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-86344 · High

Red Hat Directory Server 11, Red Hat Directory Server 11, Red Hat Directory Server 12, Red Hat Directory Server 12, Red Hat Directory Server 13, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9

Event: #72962 · Revision 1
Added to Heist Feed: Mon, 26 Oct 2026 00:20:33 GMT
Publisher date: Thu, 01 Oct 2026 22:17:05 GMT

Read the original announcement

Revision history

26 Oct 2026DEBIAN-CVE-2026-86344 · Revision 1Source updated