389-ds-base EUVD-2026-91076

No special product configuration is required - the description states the entire worker-thread pool is exhausted under default configuration, affecting anonymous and authenticated, plaintext and TLS clients. The only prerequisites are network reachability to the LDAP service and the ability to open and hold a small number of concurrent connections proportional to the configured worker-thread count. Limiting factors that reduce real-world risk: the attacker must maintain the connections for the duration of the outage (denial lasts only while connections are held), impact is confined to availability (no data disclosure or integrity loss), the connection-hold time per thread is governed by the nsslapd-ioblocktimeout setting, and exposure is bounded by whether the directory server's LDAP port is reachable from untrusted networks versus a restricted management segment.

This is a genuine, prioritizable availability risk against the specific population of hosts running 389-ds-base / Red Hat Directory Server, though not a universal emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H, base 7.5) is internally consistent with the description: it is a network-reachable, low-complexity, unauthenticated condition with pure availability impact (CWE-400 resource exhaustion), and my independent assessment agrees with every metric. The real-world attractiveness is elevated beyond a typical DoS because the attack is cheap and deterministic - exhaustion requires only a small number of connections proportional to the configured worker-thread pool, not a volumetric flood - and it defeats TLS/plaintext and authenticated/anonymous clients alike, so network-layer rate limiting and auth gating do not mitigate it. Signals are, however, limited and partly absent: no EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The absence of EPSS/KEV/POC is not itself reassuring given how mechanically simple the described technique is, but it does mean urgency rests on exposure (is LDAP reachable by untrusted networks?) rather than on observed in-the-wild activity. Net: treat as a real patch priority for internet- or multi-tenant-exposed directory servers, and lower priority where LDAP is reachable only from trusted management networks.

An attacker with network access to the LDAP port opens a handful of connections and, on each, sends one complete LDAP operation immediately followed by the opening bytes of a second, deliberately incomplete LDAPMessage. Each such connection captures a worker thread that then blocks on the connection mutex until nsslapd-ioblocktimeout expires; repeating this across a few connections sized to the worker-thread pool starves all workers and denies service to every client for as long as the connections are held. No public exploit code is referenced, but the technique as described is simple and reliably reproducible.