CVE-2026-78701: 
Linux Red Hat vulnerability analysis and mitigation

CVE-2026-78701 is a Denial of Service (DoS) vulnerability in 389-ds-base (Red Hat Directory Server) arising from an incomplete fix for a prior vulnerability (CVE-2026-11610) in the Simple Authentication and Security Layer (SASL) UNBIND process. A remote, authenticated attacker can send a specially crafted SASL UNBIND request to cause a connection to stall, leading to resource exhaustion and service unavailability. Affected products include 389-ds-base across Red Hat Directory Server streams 1.4, 11, and 12, as well as associated Red Hat Enterprise Linux packages. The vulnerability was published on August 25, 2026, with a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-787 (Out-of-bounds Write), stemming from an incomplete fix for CVE-2026-11610 in the sasl_io_recv() function. The prior fix clamped the copy size to prevent a heap buffer overflow, but failed to advance the buffered offset after a partial read. As a result, on the next receive operation, the server waits for a full N bytes instead of only the remaining N-len bytes — for example, a 562-byte UNBIND with a 512-byte connection buffer returns 512 bytes, then incorrectly waits for 562 new bytes rather than the remaining 50. A SASL-authenticated remote client can exploit this by leaving the socket open, causing the connection to stall until the I/O timeout expires; repeated connections create a resource-exhaustion DoS vector (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation results in a high availability impact: connections to the LDAP directory service stall and server resources are exhausted, rendering the service unavailable to legitimate clients. There is no confidentiality or integrity impact — the vulnerability is purely a DoS condition. Because LDAP directory services are often central to authentication and authorization infrastructure, prolonged unavailability could indirectly affect dependent services and user access across an organization (Red Hat CVE, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Red Hat CVE). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term (ENISA EUVD). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low-privilege authenticated access (a valid SASL-authenticated LDAP account), which limits the attack surface but does not eliminate risk in environments with broad LDAP account provisioning. The NVD SSVC assessment notes the vulnerability is not automatable and has only partial technical impact (Red Hat CVE).

1. Obtain LDAP credentials: Acquire any valid SASL-authenticated LDAP account on the target 389-ds-base server — this could be a low-privilege user account.
2. Establish a SASL-authenticated connection: Connect to the target LDAP service (typically port 389 or 636) and authenticate using SASL.
3. Send a crafted SASL UNBIND request: Transmit a specially crafted UNBIND request with a payload size exceeding the server's connection buffer (e.g., a 562-byte UNBIND against a 512-byte buffer). The server reads 512 bytes and then incorrectly waits for 562 more bytes instead of the remaining 50.
4. Hold the connection open: Keep the socket open without sending additional data, causing the connection to stall until the I/O timeout expires.
5. Repeat to exhaust resources: Open multiple such stalled connections in parallel to exhaust server connection resources, resulting in a Denial of Service for legitimate LDAP clients (Red Hat Bugzilla).

• Network: Unusually high number of long-lived, idle TCP connections to LDAP ports (389/tcp or 636/tcp) from one or more source IPs; connections that remain open without completing the LDAP exchange.
• Logs: 389-ds-base access logs showing repeated SASL UNBIND operations from the same authenticated client without subsequent BIND or operation activity; I/O timeout errors logged for stalled connections.
• Process/System: Elevated connection count in ns-slapd process metrics; increasing memory or file descriptor usage on the directory server without a corresponding increase in legitimate LDAP operations; server becoming unresponsive to new LDAP requests.

A patch is available from Red Hat; administrators should apply the updated 389-ds-base package as soon as it is released for their platform (tracked in Red Hat Bugzilla). As an interim workaround, Red Hat recommends restricting network access to LDAP ports (389/tcp and 636/tcp) to only trusted, authorized IP addresses or subnets using firewall rules (e.g., firewalld rich rules). Additionally, implementing authentication controls to limit which principals can establish LDAP connections and monitoring for connection stalls and resource exhaustion on the directory service are advised (Red Hat CVE).