CVE-2026-15722 Red Hat CVE debrief

Who should care

Organizations using 389 Directory Server (389-ds-base) should be aware of this vulnerability and take steps to mitigate it. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified. Affected operators, platforms, and security teams should review the vulnerability and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

CVE-2026-15722 is a stack buffer overflow flaw in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest with a replica ID field containing more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service. Users should prioritize patching to prevent potential denial-of-service attacks.

Defensive priority

Organizations using 389 Directory Server (389-ds-base) should prioritize patching to prevent potential denial-of-service attacks.

Recommended defensive actions

• Apply patches for 389 Directory Server (389-ds-base) to fix the stack buffer overflow flaw.
• Restrict access to the LDAP server to limit exposure.
• Monitor for suspicious StartNSDS50ReplicationRequest activities.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE-2026-15722 flaw is a stack buffer overflow in 389 Directory Server (389-ds-base) in the get_ruvelement_from_berval() function. A remote unauthenticated attacker can exploit this with a crafted StartNSDS50ReplicationRequest. Stack protectors limit the impact to denial of service. The vulnerability was reported by [email protected] and patched by the vendor. Users should verify affected deployments and review compensating controls.

Official resources