CVE-2026-86344

Vendor solution

As an interim mitigation, administrators can limit the number of concurrent connections permitted per source IP address in front of the LDAP listener (for example via a firewall, load balancer, or a tool such as fail2ban), since exploitation requires several simultaneous connections from the same attacker. Upgrading to a fixed package remains the only complete resolution.

Red Hat statement

This flaw allows an unauthenticated remote attacker to exhaust the entire worker-thread pool of a 389-ds-base LDAP server, denying service to all clients for as long as the attacker maintains a small number of low-cost connections. No authentication, non-default configuration, or privileged access is required to trigger this issue; it is exploitable against the default configuration of the shipped package. There is no risk to the confidentiality or integrity of directory data — no information is disclosed and no data is modified — and the condition is not persistent: normal service resumes within about a second of the attacker releasing its connections, with no restart of the directory server required.

Red Hat mitigation

As an interim mitigation, administrators can limit the number of concurrent connections permitted per source IP address in front of the LDAP listener (for example via a firewall, load balancer, or a tool such as fail2ban), since exploitation requires several simultaneous connections from the same attacker. Upgrading to a fixed package remains the only complete resolution.