CVE-2026-78701: Out-of-bounds Write in Red Hat Red Hat Enterprise Linux 10

This vulnerability affects the 389-ds-base service in Red Hat Enterprise Linux 10. It is an out-of-bounds write flaw in the SASL UNBIND process that can be exploited by a remote, authenticated attacker. Exploitation causes the server connection to stall, resulting in resource exhaustion and a denial of service condition. The CVSS v3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, reflecting network attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. The vendor advisory recommends restricting network access to LDAP ports 389 and 636 to trusted IP addresses or subnets using firewall rules. No official patch or fix is mentioned in the advisory, so patch status is not confirmed.

The vulnerability allows a remote, authenticated attacker to cause a denial of service by stalling connections to the 389-ds-base service, leading to resource exhaustion on the server. There is no impact on confidentiality or integrity, but availability is significantly affected.

The vendor advisory recommends restricting network access to the 389-ds-base service to trusted clients only. This can be done by configuring firewall rules to limit inbound connections on LDAP ports 389 and 636 to authorized IP addresses or subnets. No service restart is required after applying firewall changes. No official patch or fix is currently confirmed; therefore, network access restriction is the primary mitigation.