🔐 CVE Alert

CVE-2026-15722

HIGH 7.5

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing

CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th

A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.

CWE CWE-121
Vendor red hat
Product red hat directory server 11
Published Jul 31, 2026
Stay Ahead of the Next One

Get instant alerts for red hat red hat directory server 11

Be the first to know when new high vulnerabilities affecting red hat red hat directory server 11 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Affected Versions

Red Hat / Red Hat Directory Server 11
All versions affected
Red Hat / Red Hat Directory Server 12
All versions affected
Red Hat / Red Hat Directory Server 13
All versions affected
Red Hat / Red Hat Enterprise Linux 10
All versions affected
Red Hat / Red Hat Enterprise Linux 6
All versions affected
Red Hat / Red Hat Enterprise Linux 7
All versions affected
Red Hat / Red Hat Enterprise Linux 8
All versions affected
Red Hat / Red Hat Enterprise Linux 9
All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗
access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-15722 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2499961

Credits

Red Hat would like to thank Sebastián Alba Vives for reporting this issue.