# CVE-2026-78701: 389 Directory Server SASL UNBIND denial of service Source: https://junglewise.ai/threats/cve-2026-78701-389-directory-server-sasl-unbind-denial-of-service Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-08-25. Updated: 2026-09-25 License: CC BY 4.0 with a link back CVE-2026-78701 · Severity: medium · CVSS 6.5 · Published 2026-08-25 389 Directory Server is an open-source LDAP directory service used to manage user identities and authentication in enterprise environments. A vulnerability in its SASL UNBIND process allows authenticated attackers to send malicious requests that cause connections to hang, consuming server resources and disrupting service availability for legitimate users. ## Quick answers **Is CVE-2026-78701 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78701 being exploited in the wild. **How severe is CVE-2026-78701?** Medium severity, with a CVSS score of 6.5, published 25 August 2026. **Which products and versions are affected?** 389 Project 389 Directory Server . **Is there a fix for CVE-2026-78701?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it. **How is CVE-2026-78701 attacked?** It is attacked over the network, in a software library. **Am I affected by CVE-2026-78701?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## Technical details The vulnerability exists in the Simple Authentication and Security Layer (SASL) UNBIND process in 389-ds-base. An authenticated remote attacker can craft a specially designed request that causes a connection to stall, triggering resource exhaustion on the server. This leads to a denial of service condition. Authentication is a precondition—the attacker must first establish a valid authenticated session to exploit this flaw. The attack vector is network-based and does not require user interaction beyond the attacker's ability to send the crafted request. ## Affected products - 389 Project 389 Directory Server ## Timeline - 2026-08-25: disclosed ## References - [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/) - [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)