Executive brief
A security vulnerability has been identified in the 389 Directory Server, a service used for managing user identities and network resources. An attacker can send specially crafted directory names to the server to cause a crash or potentially gain unauthorized control over the system's memory. This could lead to a service outage or impact the integrity of the directory data.
Technical details
A heap-buffer-overflow vulnerability exists in the 389-ds-base Directory Server within the slapi_dn_normalize_ext() function. The flaw is triggered when processing a multivalued nested Relative Distinguished Name (RDN) containing legacy-quoted values. The parser fails to properly finalize tracking of nested Attribute-Value pairs (AVs) upon encountering a closing quote, leading to the use of a stale pointer. When sort_rdn_avs() subsequently performs a bubble sort, the rdn_av_swap() function executes an in-place swap that assumes contiguous memory; because of the pointer overlap, this results in a memcpy operation writing past the bounds of the destination buffer. This can be exploited by a remote, unauthenticated attacker to cause a denial of service or achieve arbitrary memory writes.
Affected products
- Red Hat 389-ds-base Red Hat Directory Server 11, 12, 13; RHEL 6, 7, 8, 9, 10
Timeline
- 2026-07-22: disclosed: CVE published and Red Hat bugzilla entry created