CVE-2026-78701: 389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos
A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server.
Other sources
Heap buffer overflow in sasliorecv() via padded SASL UNBIND fix introduced state bug in that approach. The copy clamps the size, but it does not advance the buffered offset. On the next receive the server waits for another complete N bytes instead of returning the already-buffered remainder (N - len).
Example: a 562-byte UNBIND with the default 512-byte connection buffer returns 512 bytes, then waits for 562 new bytes rather than the remaining 50. A remote SASL-authenticated client can leave the socket open, so the connection stays stalled until the I/O timeout. Repeated connections could be a resource-exhaustion / DoS vector.
CVE-2026-11610 - incomplete fix may introduce a connection-stall DoS
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to reach the server remotely and authenticate. No user interaction is required, but unauthenticated remote attackers are not indicated as able to exploit it.
What is the operational impact of successful exploitation?
A crafted SASL UNBIND request can cause a connection to stall. Repeated or sustained stalled connections can exhaust server resources and deny service.
Which part of the service should defenders focus on when assessing exposure?
Exposure is associated with the SASL UNBIND process in 389-ds-base. Systems that permit remote authenticated SASL sessions are the relevant attack surface.