# CVE-2026-16560: Red Hat 389-ds-base heap buffer overflow in rdn_av_swap

Source: https://junglewise.ai/threats/cve-2026-16560-red-hat-389-ds-base-heap-buffer-overflow-in-rdn-av-swap  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-22. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-16560 · Severity: medium · CVSS 5.3 · Published 2026-07-22

A security vulnerability has been identified in the 389 Directory Server, a service used for managing user identities and network resources. An attacker can send specially crafted directory names to the server to cause a crash or potentially gain unauthorized control over the system's memory. This could lead to a service outage or impact the integrity of the directory data.

Technologies: [Red Hat 389-Ds-Base](https://junglewise.ai/threats/technologies/389-ds-base). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-16560 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16560 being exploited in the wild.

**How severe is CVE-2026-16560?** Medium severity, with a CVSS score of 5.3, published 22 July 2026.

**Which products and versions are affected?** Red Hat 389-Ds-Base Red Hat Directory Server 11, 12, 13; RHEL 6, 7, 8, 9, 10.

**Is there a fix for CVE-2026-16560?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16560 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16560?** Check whether you run Red Hat 389-Ds-Base at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-buffer-overflow vulnerability exists in the 389-ds-base Directory Server within the slapi_dn_normalize_ext() function. The flaw is triggered when processing a multivalued nested Relative Distinguished Name (RDN) containing legacy-quoted values. The parser fails to properly finalize tracking of nested Attribute-Value pairs (AVs) upon encountering a closing quote, leading to the use of a stale pointer. When sort_rdn_avs() subsequently performs a bubble sort, the rdn_av_swap() function executes an in-place swap that assumes contiguous memory; because of the pointer overlap, this results in a memcpy operation writing past the bounds of the destination buffer. This can be exploited by a remote, unauthenticated attacker to cause a denial of service or achieve arbitrary memory writes.

## Affected products

- Red Hat 389-ds-base Red Hat Directory Server 11, 12, 13; RHEL 6, 7, 8, 9, 10

## Timeline

- 2026-07-22: disclosed: CVE published and Red Hat bugzilla entry created

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-16560](https://access.redhat.com/security/cve/CVE-2026-16560)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2506102](https://bugzilla.redhat.com/show_bug.cgi?id=2506102)

## Related threats

- [389-ds-base NULL pointer dereference in ModifyDN](https://junglewise.ai/threats/cve-2026-117548-a-null-pointer-dereference-flaw-was-found-in-389-ds-base-this)
- [389-ds-base StartTLS plaintext buffer injection](https://junglewise.ai/threats/cve-2026-86345-a-flaw-was-found-in-389-ds-base-the-server-does-not-discard)
- [Red Hat 389-ds-base Predictable IV in LDBM Attribute Encryption](https://junglewise.ai/threats/cve-2026-14969-red-hat-389-ds-base-predictable-iv-in-ldbm-attribute-encryption)
- [Red Hat 389-ds-base heap buffer overflow in sasl_io_recv](https://junglewise.ai/threats/cve-2026-11610-red-hat-389-ds-base-heap-buffer-overflow-in-sasl-io-recv)
- [Red Hat 389-ds-base heap buffer overflow in schema_attr_enum_callback](https://junglewise.ai/threats/cve-2025-14905-red-hat-389-ds-base-heap-buffer-overflow-in-schema-attr-enum)