CVE-2026-78701

389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos

Published Aug 25, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server.

Remediation

Vendor Workaround

To mitigate this issue, restrict network access to the 389-ds-base service to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the LDAP ports (typically 389 for LDAP and 636 for LDAPS) to known, authorized IP addresses or subnets. Example using `firewalld`: ```bash # firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_OR_SUBNET>" port port="389" protocol="tcp" accept' # firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_OR_SUBNET>" port port="636" protocol="tcp" accept' # firewall-cmd --reload ``` Replace `<TRUSTED_IP_OR_SUBNET>` with the actual IP addresses or network ranges of your trusted clients. This action may impact legitimate clients if not configured correctly. A service restart is not required for firewall changes to take effect.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:8
cpe:/o:redhat:rhel_els:6
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Type Values Removed Values Added
CPEs cpe:/a:redhat:directory_server:13
Type Values Removed Values Added
CPEs cpe:/a:redhat:directory_server:13 cpe:/a:redhat:directory_server:13.2::el10
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.2
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server.
Title 389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos
First Time appeared Redhat
Redhat directory Server
Redhat enterprise Linux
Weaknesses CWE-787
CPEs cpe:/a:redhat:directory_server:11
cpe:/a:redhat:directory_server:12
cpe:/a:redhat:directory_server:13
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat directory Server
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 6, 2026, 12:54 AM
Reserved
Aug 25, 2026, 5:00 AM
Status
Awaiting Analysis
Published
Aug 25, 2026, 8:18 AM
Modified
Nov 6, 2026, 1:17 AM
Severity
Moderate
Public date
Aug 24, 2026, 12:00 PM