# CVE-2026-86344: 389-ds-base denial of service via LDAP connection requeue

Source: https://junglewise.ai/threats/cve-2026-86344-a-flaw-was-found-in-389-ds-base-an-unauthenticated-remote  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-86344 · Severity: high · CVSS 7.5 · Published 2026-10-01

389-ds-base is an open-source LDAP directory server used to store and manage user and group information in enterprise environments. An unauthenticated attacker can send specially crafted LDAP messages to exhaust the server's worker thread pool, preventing all legitimate users—whether anonymous or authenticated—from accessing the directory until the attacker closes their connections. The attack requires no credentials, no special configuration, and leaves no persistent damage; normal service resumes automatically once the attacker disconnects.

Vendors: [389 Project](https://junglewise.ai/threats/vendors/389-project).

## Quick answers

**Is CVE-2026-86344 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86344 being exploited in the wild.

**How severe is CVE-2026-86344?** High severity, with a CVSS score of 7.5, published 1 October 2026.

**Which products and versions are affected?** 389 Project 389-ds-base.

**Is there a fix for CVE-2026-86344?** No fixed version is recorded yet. As an interim mitigation, administrators can limit the number of concurrent connections permitted per source IP address using a firewall, load balancer, or fail2ban, since the exploit requires several simultaneous connections from the same attacker. Upgrading to a fixed package remains the only complete resolution. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86344 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-86344?** Check whether you run 389 Project 389-Ds-Base. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


As an interim mitigation, administrators can limit the number of concurrent connections permitted per source IP address using a firewall, load balancer, or fail2ban, since the exploit requires several simultaneous connections from the same attacker. Upgrading to a fixed package remains the only complete resolution.

## Technical details

An unauthenticated remote attacker can send a complete LDAP operation followed by incomplete bytes on the same connection, causing the server to hand the connection between worker threads before the result is flushed. The second worker blocks on I/O timeout while holding the connection mutex, preventing result delivery. Repeating this pattern across a small number of connections (proportional to the worker thread pool size) exhausts the entire pool and causes denial of service. The vulnerability requires no authentication or non-default configuration and affects both plaintext and TLS connections.

## Affected products

- 389 Project 389-ds-base

## Timeline

- 2026-10-01: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-86344](https://access.redhat.com/security/cve/CVE-2026-86344)