CVE-2026-15722
published 2026-07-31CVE-2026-15722: A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters…
PriorityP350high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.83%
57.1th percentile
A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 389-ds_1.4 | 389-ds-base | — | — |
| port389 | 389-ds-base | — | — |
| redhat-ds_11 | 389-ds-base | — | — |
| redhat-ds_12 | 389-ds-base | — | — |
| redhat | directory_server | — | — |
| redhat | directory_server | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Red Hat Directory Server/Enterprise Linux Replication repl5_ruv.c get_ruvelement_from_berval stack-based overflow (EUVD-2026-51509 / Nessus ID 337345)
vuldb·2026-08-18·CVSS 7.5
CVE-2026-15722 [HIGH] Red Hat Directory Server/Enterprise Linux Replication repl5_ruv.c get_ruvelement_from_berval stack-based overflow (EUVD-2026-51509 / Nessus ID 337345)
A vulnerability, which was classified as critical, was found in Red Hat Directory Server and Enterprise Linux. This vulnerability affects the function get_ruvelement_from_berval of the file repl5_ruv.c of the component Replication. Such manipulation leads to stack-based buffer overflow.
This vulnerability is listed as CVE-2026-15722. The attack may be performed from remote. There is no available exploit.
GHSA
A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base).
ghsa_unreviewed·2026-07-31
CVE-2026-15722 [HIGH] CWE-121 A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base).
A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.
Red Hat
389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing
vendor_redhat·2026-07-31·CVSS 7.5
CVE-2026-15722 [HIGH] CWE-121 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing
389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing
A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.
Statement: This flaw allows a remote unauthenticated attacker to crash the 389 Directory
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-15722 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing [fedora-all]
bugzilla·2026-07-31·CVSS 7.5
CVE-2026-15722 [HIGH] CVE-2026-15722 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing [fedora-all]
CVE-2026-15722 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in ldap/servers/plugins/replication/repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer (ridbuff[RIDSTR_SIZE]) without bounds checking the loop counter. A remote unauthenticated attacker can crash the ns-slapd process by sending a crafted StartNSDS50ReplicationRe
Bugzilla
CVE-2026-15722 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing
bugzilla·2026-07-14·CVSS 7.5
CVE-2026-15722 [HIGH] CVE-2026-15722 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing
CVE-2026-15722 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing
A flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in ldap/servers/plugins/replication/repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer (ridbuff[RIDSTR_SIZE]) without bounds checking the loop counter. A remote unauthenticated attacker can crash the ns-slapd process by sending a crafted StartNSDS50ReplicationRequest LDAP extended operation (OID 2.16.840.1.113730.3.5.12) containing more than 16 consecutive digit characters in the replica ID field. The overflow occurs during payload decoding in decode_startrepl_extop(), before the replica_is_upda
https://access.redhat.com/errata/RHSA-2026:55421https://access.redhat.com/errata/RHSA-2026:55422https://access.redhat.com/errata/RHSA-2026:55423https://access.redhat.com/errata/RHSA-2026:55424https://access.redhat.com/errata/RHSA-2026:55425https://access.redhat.com/errata/RHSA-2026:55426https://access.redhat.com/errata/RHSA-2026:55530https://access.redhat.com/errata/RHSA-2026:55532https://access.redhat.com/errata/RHSA-2026:55756https://access.redhat.com/errata/RHSA-2026:55757https://access.redhat.com/errata/RHSA-2026:55758https://access.redhat.com/errata/RHSA-2026:55794https://access.redhat.com/errata/RHSA-2026:56047https://access.redhat.com/errata/RHSA-2026:56048https://access.redhat.com/errata/RHSA-2026:56050https://access.redhat.com/errata/RHSA-2026:79217https://access.redhat.com/security/cve/CVE-2026-15722https://bugzilla.redhat.com/show_bug.cgi?id=2499961
2026-07-31
Published