Every CVE Search/ Get API key

CVE-2026-78701

389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos

6.5 Medium

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.78%Up 0.4 points since Aug 25, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server.

Record
CVE-2026-78701
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-06
EUVDEUVD-2026-65312 6.5

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server.

Record
EUVD-2026-65312
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-06
GitHub AdvisoriesGHSA-xmh3-2gr9-2rwp 6.5

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability...

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server.

Record
GHSA-xmh3-2gr9-2rwp
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 6.5

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server.

Record
CVE-2026-78701
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-06
OSVRHSA-2026:64784 9.8

Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

Record
RHSA-2026:64784
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:64785 9.8

Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

Record
RHSA-2026:64785
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVRLSA-2026:64784 9.8

Critical: 389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

  • 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355)

  • 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453)

  • 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922)

  • 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560)

  • 389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS (CVE-2026-78701)

Bug Fix(es) and Enhancement(s):

  • lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [rhel-9.8.z] (JIRA:Rocky Linux-244467)

  • fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [rhel-9.8.z] (JIRA:Rocky Linux-248766)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:64784
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:64785 9.8

Critical: 389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

  • 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355)

  • 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453)

  • 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922)

  • 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560)

  • 389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS (CVE-2026-78701)

Bug Fix(es) and Enhancement(s):

  • lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [rhel-10.2.z] (JIRA:Rocky Linux-244470)

  • fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [rhel-10.2.z] (JIRA:Rocky Linux-248770)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:64785
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-78701 6.5

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server.

Record
UBUNTU-CVE-2026-78701
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:64784 No score

Critical: 389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

  • 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355)
  • 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453)
  • 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922)
  • 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560)
  • 389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS (CVE-2026-78701)

Bug Fix(es) and Enhancement(s):

  • lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [almalinux-9.8.z] (JIRA:AlmaLinux-244467)
  • fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [almalinux-9.8.z] (JIRA:AlmaLinux-248766)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:64784
Updated
2026-11-02
OSVALSA-2026:64785 No score

Critical: 389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

  • 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355)
  • 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453)
  • 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922)
  • 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560)
  • 389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS (CVE-2026-78701)

Bug Fix(es) and Enhancement(s):

  • lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [almalinux-10.2.z] (JIRA:AlmaLinux-244470)
  • fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [almalinux-10.2.z] (JIRA:AlmaLinux-248770)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:64785
Updated
2026-11-02
OSVAZL-98045 No score

CVE-2026-78701 affecting package 389-ds-base 3.1.1-12

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server.

Record
AZL-98045
Updated
2026-11-05
OSVCLSA-2026-1789654818 No score

389-ds-base: Fix of 5 CVEs

  • CVE-2026-18355: reject SASL packet lengths below the already-consumed offset in sasl_io_start_packet
  • CVE-2026-18453: avoid NULL pointer dereference in op_shared_search with paged results and USE_ONE_BACKEND
  • CVE-2026-18922: clear the stale SASL identity in the Cyrus SASL auxiliary property lookup
  • CVE-2026-76560: require a non-empty bind DN when evaluating SELFDN ACI bind rules
  • CVE-2026-78701: drain a buffered unencrypted UNBIND across recv calls instead of stalling the connection
Record
CLSA-2026-1789654818
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
389-ds-base
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2.8.0-10.el9_8
2.8.0-10.el9_8
389-ds-base-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2.8.0-10.el9_8
2.8.0-10.el9_8
389-ds-base-libs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2.8.0-10.el9_8
2.8.0-10.el9_8
389-ds-base-snmp
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2.8.0-10.el9_8
2.8.0-10.el9_8
python3-lib389
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2.8.0-10.el9_8
2.8.0-10.el9_8
389-ds-base
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.2.0-10.el10_2
3.2.0-10.el10_2
389-ds-base-bdb
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.2.0-10.el10_2
3.2.0-10.el10_2
389-ds-base-devel
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.2.0-10.el10_2
3.2.0-10.el10_2
389-ds-base-libs
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.2.0-10.el10_2
3.2.0-10.el10_2
389-ds-base-snmp
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.2.0-10.el10_2
3.2.0-10.el10_2
Show 40 moreShow less
Affected packages
PackageAffectedFixed
python3-lib389
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.2.0-10.el10_2
3.2.0-10.el10_2
389-ds-base
Azure Linux:3
 through 3.1.1-12 None known
389-ds-base
TuxCare:AlmaLinux:9.2
From an advisory covering 5 CVEs
 before 2.2.4-5.el9_2.tuxcare.els10
2.2.4-5.el9_2.tuxcare.els10
389-ds-base-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 5 CVEs
 before 2.2.4-5.el9_2.tuxcare.els10
2.2.4-5.el9_2.tuxcare.els10
389-ds-base-libs
TuxCare:AlmaLinux:9.2
From an advisory covering 5 CVEs
 before 2.2.4-5.el9_2.tuxcare.els10
2.2.4-5.el9_2.tuxcare.els10
389-ds-base-snmp
TuxCare:AlmaLinux:9.2
From an advisory covering 5 CVEs
 before 2.2.4-5.el9_2.tuxcare.els10
2.2.4-5.el9_2.tuxcare.els10
python3-lib389
TuxCare:AlmaLinux:9.2
From an advisory covering 5 CVEs
 before 2.2.4-5.el9_2.tuxcare.els10
2.2.4-5.el9_2.tuxcare.els10
389-ds-base
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:2.8.0-10.el9_8
0:2.8.0-10.el9_8
389-ds-base-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:2.8.0-10.el9_8
0:2.8.0-10.el9_8
389-ds-base-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:2.8.0-10.el9_8
0:2.8.0-10.el9_8
389-ds-base-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:2.8.0-10.el9_8
0:2.8.0-10.el9_8
389-ds-base-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:2.8.0-10.el9_8
0:2.8.0-10.el9_8
389-ds-base-snmp
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:2.8.0-10.el9_8
0:2.8.0-10.el9_8
389-ds-base-snmp-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:2.8.0-10.el9_8
0:2.8.0-10.el9_8
python3-lib389
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:2.8.0-10.el9_8
0:2.8.0-10.el9_8
389-ds-base-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 5 CVEs
 before 0:2.8.0-10.el9_8
0:2.8.0-10.el9_8
389-ds-base-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 5 CVEs
 before 0:2.8.0-10.el9_8
0:2.8.0-10.el9_8
389-ds-base-devel
Red Hat:enterprise_linux:9::crb
From an advisory covering 5 CVEs
 before 0:2.8.0-10.el9_8
0:2.8.0-10.el9_8
389-ds-base-libs-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 5 CVEs
 before 0:2.8.0-10.el9_8
0:2.8.0-10.el9_8
389-ds-base-snmp-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 5 CVEs
 before 0:2.8.0-10.el9_8
0:2.8.0-10.el9_8
389-ds-base
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:3.2.0-10.el10_2
0:3.2.0-10.el10_2
389-ds-base-bdb-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:3.2.0-10.el10_2
0:3.2.0-10.el10_2
389-ds-base-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:3.2.0-10.el10_2
0:3.2.0-10.el10_2
389-ds-base-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:3.2.0-10.el10_2
0:3.2.0-10.el10_2
389-ds-base-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:3.2.0-10.el10_2
0:3.2.0-10.el10_2
389-ds-base-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:3.2.0-10.el10_2
0:3.2.0-10.el10_2
389-ds-base-snmp
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:3.2.0-10.el10_2
0:3.2.0-10.el10_2
389-ds-base-snmp-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:3.2.0-10.el10_2
0:3.2.0-10.el10_2
python3-lib389
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:3.2.0-10.el10_2
0:3.2.0-10.el10_2
389-ds-base-bdb
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:3.2.0-10.el10_2
0:3.2.0-10.el10_2
389-ds-base-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:3.2.0-10.el10_2
0:3.2.0-10.el10_2
389-ds-base
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:2.8.0-10.el9_8
0:2.8.0-10.el9_8
389-ds-base
Rocky Linux:10
From an advisory covering 5 CVEs
 before 0:3.2.0-10.el10_2
0:3.2.0-10.el10_2
389-ds-base
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.3.3.12-1build11.3.3.13-11.3.4.5-21.3.4.8-11.3.4.8-3
Show 4 moreShow less
1.3.4.8-3ubuntu11.3.4.8-41.3.4.9-11.3.4.9-1ubuntu0.1~esm1
 None known
389-ds-base
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.3.7.5-11.3.7.5-1build11.3.7.5-1build21.3.7.9-11.3.7.10-11.3.7.10-1ubuntu11.3.7.10-1ubuntu1+esm1
 None known
389-ds-base
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.4.1.6-41.4.1.6-4build11.4.2.4-11.4.2.4-1build11.4.3.2-11.4.3.2-1build11.4.3.6-21.4.3.6-2ubuntu0.1~esm1
 None known
389-ds-base
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.4.4.11-2build11.4.4.11-2build21.4.4.17-12.0.11-22.0.14-12.0.15-12.0.15-1ubuntu2
 None known
389-ds-base
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.3.4+dfsg1-12.4.4+dfsg1-1ubuntu12.4.4+dfsg1-1ubuntu42.4.4+dfsg1-32.4.5+dfsg1-1
 None known
389-ds-base
Ubuntu:26.10
 All versions, plus listed versions
3.1.2+vendor1-23.1.2+vendor1-2build13.3.1-3
 None known
389-ds-base
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.1.2+dfsg1-13.1.2+vendor1-2
 None known

History

History
RecordedChangedSources
affected, factsCVE List, EUVD, NVD
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-78701 is a medium vulnerability (CVSS 6.5) in Red Hat Directory Server 11, published August 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 56th percentile. No source names a fixed version.

References

Show 32 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open