CVE-2026-15722
Received Received - Intake

Stack Buffer Overflow in 389 Directory Server

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: Red Hat, Inc.

Description
A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-15722
EUVD
EUVD-2026-51509

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat 389_directory_server *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack buffer overflow vulnerability in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation with a replica ID field containing more than 16 digit characters.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes in the 389 Directory Server (389-ds-base) service. Check logs for LDAP server crashes or segmentation faults. Monitor network traffic for unusually large StartNSDS50ReplicationRequest operations with replica ID fields exceeding 16 digits.

Impact Analysis

The vulnerability allows a remote unauthenticated attacker to crash the LDAP server, causing a denial of service. The stack protector limits the impact to denial of service rather than allowing arbitrary code execution.

Compliance Impact

This vulnerability primarily causes denial of service by crashing the LDAP server, which could disrupt access to critical identity management services. For compliance with standards like GDPR or HIPAA, such disruptions may impact availability of personal or health data systems, potentially violating requirements for timely access or service continuity. The lack of authentication requirement increases risk of unauthorized service disruption.

Mitigation Strategies

Apply the latest security patches for 389 Directory Server immediately. If patches are unavailable, restrict network access to the LDAP server by blocking external connections to the LDAP port (default 389/tcp). Monitor for exploitation attempts and disable the StartNSDS50ReplicationRequest extended operation if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15722. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart