Is CVE-2026-16560 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16560 being exploited in the wild.

How severe is CVE-2026-16560?

Medium severity, with a CVSS score of 5.3, published 22 July 2026.

Which products and versions are affected?

Red Hat 389-Ds-Base Red Hat Directory Server 11, 12, 13; RHEL 6, 7, 8, 9, 10.

Is there a fix for CVE-2026-16560?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16560 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16560?

Check whether you run Red Hat 389-Ds-Base at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16560: Red Hat 389-ds-base heap buffer overflow in rdn_av_swap

CVE-2026-16560 · Severity: medium · CVSS 5.3 · Published 2026-07-22

A security vulnerability has been identified in the 389 Directory Server, a service used for managing user identities and network resources. An attacker can send specially crafted directory names to the server to cause a crash or potentially gain unauthorized control over the system's memory. This could lead to a service outage or impact the integrity of the directory data.

Technologies: Red Hat 389-Ds-Base. Vendors: Red Hat.

Quick answers

Is CVE-2026-16560 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16560 being exploited in the wild.
How severe is CVE-2026-16560?: Medium severity, with a CVSS score of 5.3, published 22 July 2026.
Which products and versions are affected?: Red Hat 389-Ds-Base Red Hat Directory Server 11, 12, 13; RHEL 6, 7, 8, 9, 10.
Is there a fix for CVE-2026-16560?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16560 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16560?: Check whether you run Red Hat 389-Ds-Base at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-buffer-overflow vulnerability exists in the 389-ds-base Directory Server within the slapi_dn_normalize_ext() function. The flaw is triggered when processing a multivalued nested Relative Distinguished Name (RDN) containing legacy-quoted values. The parser fails to properly finalize tracking of nested Attribute-Value pairs (AVs) upon encountering a closing quote, leading to the use of a stale pointer. When sort_rdn_avs() subsequently performs a bubble sort, the rdn_av_swap() function executes an in-place swap that assumes contiguous memory; because of the pointer overlap, this results in a memcpy operation writing past the bounds of the destination buffer. This can be exploited by a remote, unauthenticated attacker to cause a denial of service or achieve arbitrary memory writes.

Affected products

Red Hat 389-ds-base Red Hat Directory Server 11, 12, 13; RHEL 6, 7, 8, 9, 10

Timeline

2026-07-22: disclosed: CVE published and Red Hat bugzilla entry created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.