Skip to content
Heist/ feed
High

DEBIAN-CVE-2026-86344

Type: advisorySource: OSV1 source record

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2026-86344

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-86344

389-ds-base

Source reference: /affected/0/package/name

Affected versions
2.3.1+dfsg1-1

Source reference: /affected/0/versions

2.3.1+dfsg1-1+deb12u1

Source reference: /affected/0/versions

2.3.4+dfsg1-1

Source reference: /affected/0/versions

2.3.4+dfsg1-1.1

Source reference: /affected/0/versions

2.4.4+dfsg1-1

Source reference: /affected/0/versions

2.4.4+dfsg1-3

Source reference: /affected/0/versions

2.4.5+dfsg1-1

Source reference: /affected/0/versions

3.0.2+dfsg1-1

Source reference: /affected/0/versions

3.1.1+dfsg1-1

Source reference: /affected/0/versions

3.1.1+dfsg1-2

Source reference: /affected/0/versions

3.1.1+dfsg1-3

Source reference: /affected/0/versions

3.1.2+dfsg1-1

Source reference: /affected/0/versions

3.1.2+vendor1-1

Source reference: /affected/0/versions

3.1.2+vendor1-2

Source reference: /affected/0/versions

3.3.0-1

Source reference: /affected/0/versions

3.3.0-2

Source reference: /affected/0/versions

3.3.1-1

Source reference: /affected/0/versions

3.3.1-3

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

389-ds-base

Source reference: /affected/1/package/name

Affected versions
3.1.2+dfsg1-1

Source reference: /affected/1/versions

3.1.2+dfsg1-1+deb13u1

Source reference: /affected/1/versions

3.1.2+vendor1-1

Source reference: /affected/1/versions

3.1.2+vendor1-2

Source reference: /affected/1/versions

3.3.0-1

Source reference: /affected/1/versions

3.3.0-2

Source reference: /affected/1/versions

3.3.1-1

Source reference: /affected/1/versions

3.3.1-3

Source reference: /affected/1/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "389-ds-base",
      "purl": "pkg:deb/debian/389-ds-base?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "2.3.1+dfsg1-1",
      "2.3.1+dfsg1-1+deb12u1",
      "2.3.4+dfsg1-1",
      "2.3.4+dfsg1-1.1",
      "2.4.4+dfsg1-1",
      "2.4.4+dfsg1-3",
      "2.4.5+dfsg1-1",
      "3.0.2+dfsg1-1",
      "3.1.1+dfsg1-1",
      "3.1.1+dfsg1-2",
      "3.1.1+dfsg1-3",
      "3.1.2+dfsg1-1",
      "3.1.2+vendor1-1",
      "3.1.2+vendor1-2",
      "3.3.0-1",
      "3.3.0-2",
      "3.3.1-1",
      "3.3.1-3"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-86344.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "389-ds-base",
      "purl": "pkg:deb/debian/389-ds-base?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "3.1.2+dfsg1-1",
      "3.1.2+dfsg1-1+deb13u1",
      "3.1.2+vendor1-1",
      "3.1.2+vendor1-2",
      "3.3.0-1",
      "3.3.0-2",
      "3.3.1-1",
      "3.3.1-3"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-86344.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]
Related CVEs
CVE-2026-86344

Source reference: /upstream

Publisher severity

high

Source reference: /severity/0/score

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-86344 · High

Red Hat Directory Server 11, Red Hat Directory Server 11, Red Hat Directory Server 12, Red Hat Directory Server 12, Red Hat Directory Server 13, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9

Event
#72962 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement