AIKIDO-2026-854944

TL;DR

FreeDSx/LDAP's default PcntlServerRunner forks a new OS process for every accepted TCP connection before any LDAP bind or authentication, with no limit on how many child processes can run concurrently. A remote, unauthenticated peer can open many idle connections to the LDAP server's listening port and force the host to keep forking, exhausting the process table, memory, and CPU scheduling capacity. The fix adds a max_clients option, defaulting to 1024, that cleans up finished children and rejects new connections once the limit is reached.