Executive brief
A security vulnerability exists in the 389 Directory Server, a popular open-source enterprise directory service used for managing user identities and access. An unauthenticated remote attacker can exploit this flaw to crash the server by sending a specially crafted network request. This results in a denial of service, potentially disrupting login services and other business operations that rely on the directory for authentication.
Technical details
A stack-based buffer overflow exists in the get_ruvelement_from_berval() function within repl5_ruv.c of the 389 Directory Server (389-ds-base). The vulnerability is caused by a lack of bounds checking when copying digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer. An unauthenticated remote attacker can trigger the overflow by sending a StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digits. Because the overflow occurs during payload decoding before authorization checks, it can be exploited anonymously. While stack protectors typically limit the impact to a process crash (Denial of Service), the flaw represents a significant availability risk.
Affected products
- Red Hat 389 Directory Server (389-ds-base) Red Hat Directory Server 11, 12; RHEL 7, 8, 9, 10
Timeline
- 2026-07-14: other: Reported to Red Hat Bugzilla
- 2026-07-31: disclosed: Public disclosure of CVE-2026-15722