CVE-2026-78701389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos

Description

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server.

Timeline

Scores

EPSS (exploitation in 30 days)

0.78% · top 44% of all CVEs (13 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Affected products

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 0:3.2.0-10.el10_2 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:2.8.0-10.el9_8 – < *

• Red Hat · Red Hat Directory Server 13.2

  • unaffected 1788851765 – < *

• Red Hat · Red Hat Directory Server 11

  All versions: affected

• Red Hat · Red Hat Directory Server 12

  All versions: affected

• Red Hat · Red Hat Directory Server 13

  All versions: affected

• Red Hat · Red Hat Enterprise Linux 6

  All versions: affected

• Red Hat · Red Hat Enterprise Linux 7

  All versions: affected

• Red Hat · Red Hat Enterprise Linux 8

  All versions: affected

What to do

Workaround: To mitigate this issue, restrict network access to the 389-ds-base service to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the LDAP ports (typically 389 for LDAP and 636 for LDAPS) to known, authorized IP addresses or subnets. Example using `firewalld`: ```bash # firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_OR_SUBNET>" port port="389" protocol="tcp" accept' # firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_OR_SUBNET>" port port="636" protocol="tcp" accept' # firewall-cmd --reload ``` Replace `<TRUSTED_IP_OR_SUBNET>` with the actual IP addresses or network ranges of your trusted clients. This action may impact legitimate clients if not configured correctly. A service restart is not required for firewall changes to take effect.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-65312 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-78701](https://cveledger.app/badge/CVE-2026-78701.svg)](https://cveledger.app/cve/CVE-2026-78701)

Record last updated 6 Nov 2026, 00:54 UTC.