{"id":"AZL-107951","summary":"CVE-2026-86344 affecting package 389-ds-base 3.1.1-12","details":"A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.","modified":"2026-10-14T05:33:08Z","published":"2026-10-01T22:17:05Z","upstream":["CVE-2026-86344"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86344"}],"affected":[{"package":{"name":"389-ds-base","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/389-ds-base"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.1-12"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-107951.json"}}],"schema_version":"1.9.0"}