Stack Buffer Overflow Vulnerability in 389 Directory Server by Red Hat
CVE-2026-15722

7.5HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Directory Server 11
Red Hat Directory Server 12
Red Hat Directory Server 13
Red Hat Enterprise Linux 10
Vendor
CVE Published:
31 July 2026

What is CVE-2026-15722?

A stack buffer overflow vulnerability exists in the 389 Directory Server, specifically within the get_ruvelement_from_berval() function located in repl5_ruv.c. This flaw allows a remote, unauthenticated attacker to send a malicious StartNSDS50ReplicationRequest that exceeds the bounds of a 16-byte fixed stack buffer by including a replica ID with more than 16 digit characters. This overflow can cause the LDAP server to crash due to the lack of proper bounds checking during payload decoding, occurring before any authorization checks are performed. Although stack protectors mitigate the potential impact, the vulnerability can still lead to denial of service conditions.

References

https://access.redhat.com/security/cve/CVE-2026-15722
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2499961
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Sebastián Alba Vives for reporting this issue.
.