Read the docs
TI-2026-13229 Aliases CVE-2026-15722GHSA-5gg4-m865-6qwr

Stack-based buffer overflow in Red Hat Directory Server 11.5 E4S for RHEL 8

Priority MEDIUM 40CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 24 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-121 and the CVSS impact.

Summary

A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0083 57th percentileScored 2026-11-07
Fix Partial Red Hat: 16 advisoriesRed Hat: 24 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Directory Server 11.5 E4S for RHEL 8—8060020260908152739.0ca98e7ePatch availableCNA
Red HatRed Hat Directory Server 11.7 E4S for RHEL 8—8080020260806114250.f969626ePatch availableCNA
Red HatRed Hat Directory Server 11.9 for RHEL 8—8100020260803140625.37ed7c03Patch availableCNA
Red HatRed Hat Directory Server 12.2 E4S for RHEL 9—9020020260730155601.1674d574Patch availableCNA
Red HatRed Hat Directory Server 12.4 E4S for RHEL 9—9040020260810131422.1674d574Patch availableCNA
Red HatRed Hat Enterprise Linux 10—3.2.0-9.el10_2Patch availableCNA
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—3.0.6-20.el10_0Patch availableCNA
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—1.3.11.1-14.el7_9Patch availableCNA
Red HatRed Hat Enterprise Linux 8—8100020260806150504.25e700aaPatch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—8040020260803141511.96015a92Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—8040020260803141511.96015a92Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—8060020260806120442.824efc52Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On—8060020260806120442.824efc52Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—8080020260806114228.6dbb3803Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—8080020260806114228.6dbb3803Patch availableCNA
Red HatRed Hat Enterprise Linux 9—2.8.0-9.el9_8Patch availableCNA
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—2.2.4-20.el9_2Patch availableCNA
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—2.4.5-27.el9_4Patch availableCNA
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—2.6.1-23.el9_6Patch availableCNA
Red HatRed Hat Directory Server 12——No fix listedCNA
Red HatRed Hat Directory Server 13——Not affectedCNA
Red HatRed Hat Enterprise Linux 6——No fix listedCNA
  • Red Hat Directory Server 11.5 E4S for RHEL 8 VendorRed Hat Affected — Fixed in 8060020260908152739.0ca98e7e Patch available CNA
  • Red Hat Directory Server 11.7 E4S for RHEL 8 VendorRed Hat Affected — Fixed in 8080020260806114250.f969626e Patch available CNA
  • Red Hat Directory Server 11.9 for RHEL 8 VendorRed Hat Affected — Fixed in 8100020260803140625.37ed7c03 Patch available CNA
  • Red Hat Directory Server 12.2 E4S for RHEL 9 VendorRed Hat Affected — Fixed in 9020020260730155601.1674d574 Patch available CNA
  • Red Hat Directory Server 12.4 E4S for RHEL 9 VendorRed Hat Affected — Fixed in 9040020260810131422.1674d574 Patch available CNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 3.2.0-9.el10_2 Patch available CNA
  • Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 3.0.6-20.el10_0 Patch available CNA
  • Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 1.3.11.1-14.el7_9 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8100020260806150504.25e700aa Patch available CNA
  • Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8040020260803141511.96015a92 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 8040020260803141511.96015a92 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8060020260806120442.824efc52 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 8060020260806120442.824efc52 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8080020260806114228.6dbb3803 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8080020260806114228.6dbb3803 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.8.0-9.el9_8 Patch available CNA
  • Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.2.4-20.el9_2 Patch available CNA
  • Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.4.5-27.el9_4 Patch available CNA
  • Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 2.6.1-23.el9_6 Patch available CNA
  • Red Hat Directory Server 12 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Directory Server 13 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:redhat:directory_server:11.0:*:*:*:*:*:*:*11.0VulnerableRed Hat
cpe:2.3:a:redhat:directory_server:12.0:*:*:*:*:*:*:*12.0VulnerableRed Hat
cpe:2.3:o:redhat:389_directory_server:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*10.0VulnerableRed Hat
  • cpe:2.3:a:redhat:directory_server:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:directory_server:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:389_directory_server:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat

Remediation

Red Hat 16 advisories

  • RHSA-2026:79217 Released 2026-10-08 · Red Hat rating Critical
    redhat-ds:11 security, bug fix, and enhancement update
    • Red Hat Directory Server 11.5 E4S for RHEL 8 389-ds-base-1.4.3.34-9.module+el8dsrv+24847+c94540a6.src::redhat-ds:11, 389-ds-base-1.4.3.34-9.module+el8dsrv+24847+c94540a6.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.3.34-9.module+el8dsrv+24847+c94540a6.x86_64::redhat-ds:11 +5
  • RHSA-2026:56050 Released 2026-08-18 · Red Hat rating Important
    redhat-ds:12 security update
    • Red Hat Directory Server 12.4 E4S for RHEL 9 389-ds-base-2.4.5-25.module+el9dsrv+24653+2bc8f722.src::redhat-ds:12, 389-ds-base-2.4.5-25.module+el9dsrv+24653+2bc8f722.x86_64::redhat-ds:12, 389-ds-base-devel-2.4.5-25.module+el9dsrv+24653+2bc8f722.x86_64::redhat-ds:12 +4
  • RHSA-2026:56048 Released 2026-08-18 · Red Hat rating Important
    redhat-ds:12 security update
    • Red Hat Directory Server 12.2 E4S for RHEL 9 389-ds-base-2.2.7-17.module+el9dsrv+24586+9fc9d4dc.src::redhat-ds:12, 389-ds-base-2.2.7-17.module+el9dsrv+24586+9fc9d4dc.x86_64::redhat-ds:12, 389-ds-base-devel-2.2.7-17.module+el9dsrv+24586+9fc9d4dc.x86_64::redhat-ds:12 +4
Show 13 more Red Hat advisories
  • RHSA-2026:56047 Released 2026-08-18 · Red Hat rating Important
    redhat-ds:11 security update
    • Red Hat Directory Server 11.7 E4S for RHEL 8 389-ds-base-1.4.3.34-17.module+el8dsrv+24648+b4844542.src::redhat-ds:11, 389-ds-base-1.4.3.34-17.module+el8dsrv+24648+b4844542.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.3.34-17.module+el8dsrv+24648+b4844542.x86_64::redhat-ds:11 +5
  • RHSA-2026:55794 Released 2026-08-17 · Red Hat rating Important
    389-ds:1.4 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) 389-ds-base-1.4.3.35-20.module+el8.8.0+24646+9b151ec7.ppc64le::389-ds:1.4, 389-ds-base-1.4.3.35-20.module+el8.8.0+24646+9b151ec7.src::389-ds:1.4, 389-ds-base-1.4.3.35-20.module+el8.8.0+24646+9b151ec7.x86_64::389-ds:1.4 +9
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) 389-ds-base-1.4.3.35-20.module+el8.8.0+24646+9b151ec7.src::389-ds:1.4, 389-ds-base-1.4.3.35-20.module+el8.8.0+24646+9b151ec7.x86_64::389-ds:1.4, 389-ds-base-devel-1.4.3.35-20.module+el8.8.0+24646+9b151ec7.x86_64::389-ds:1.4 +4
  • RHSA-2026:55758 Released 2026-08-17 · Red Hat rating Important
    389-ds-base security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) 389-ds-base-1.3.11.1-14.el7_9, 389-ds-base-libs-1.3.11.1-14.el7_9
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) 389-ds-base-1.3.11.1-14.el7_9, 389-ds-base-devel-1.3.11.1-14.el7_9, 389-ds-base-libs-1.3.11.1-14.el7_9 +1
  • RHSA-2026:55756 Released 2026-08-17 · Red Hat rating Important
    389-ds:1.4 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) 389-ds-base-1.4.3.34-11.module+el8.6.0+24647+ee33cdf8.src::389-ds:1.4, 389-ds-base-1.4.3.34-11.module+el8.6.0+24647+ee33cdf8.x86_64::389-ds:1.4, 389-ds-base-devel-1.4.3.34-11.module+el8.6.0+24647+ee33cdf8.x86_64::389-ds:1.4 +4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) 389-ds-base-1.4.3.34-11.module+el8.6.0+24647+ee33cdf8.src::389-ds:1.4, 389-ds-base-1.4.3.34-11.module+el8.6.0+24647+ee33cdf8.x86_64::389-ds:1.4, 389-ds-base-devel-1.4.3.34-11.module+el8.6.0+24647+ee33cdf8.x86_64::389-ds:1.4 +4
  • RHSA-2026:55757 Released 2026-08-17 · Red Hat rating Important
    389-ds:1.4 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) 389-ds-base-1.4.3.34-6.module+el8.4.0+24619+217e1084.src::389-ds:1.4, 389-ds-base-1.4.3.34-6.module+el8.4.0+24619+217e1084.x86_64::389-ds:1.4, 389-ds-base-devel-1.4.3.34-6.module+el8.4.0+24619+217e1084.x86_64::389-ds:1.4 +4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) 389-ds-base-1.4.3.34-6.module+el8.4.0+24619+217e1084.src::389-ds:1.4, 389-ds-base-1.4.3.34-6.module+el8.4.0+24619+217e1084.x86_64::389-ds:1.4, 389-ds-base-devel-1.4.3.34-6.module+el8.4.0+24619+217e1084.x86_64::389-ds:1.4 +4
  • RHSA-2026:55530 Released 2026-08-17 · Red Hat rating Important
    389-ds:1.4 security update
    • Red Hat Enterprise Linux AppStream (v. 8) 389-ds-base-1.4.3.39-26.module+el8.10.0+24634+ded7774b.aarch64::389-ds:1.4, 389-ds-base-1.4.3.39-26.module+el8.10.0+24634+ded7774b.ppc64le::389-ds:1.4, 389-ds-base-1.4.3.39-26.module+el8.10.0+24634+ded7774b.s390x::389-ds:1.4 +19
  • RHSA-2026:55532 Released 2026-08-17 · Red Hat rating Important
    redhat-ds:11 security update
    • Red Hat Directory Server 11.9 for RHEL 8 389-ds-base-1.4.3.39-26.module+el8dsrv+24624+a4839c0f.src::redhat-ds:11, 389-ds-base-1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.3.39-26.module+el8dsrv+24624+a4839c0f.x86_64::redhat-ds:11 +5
  • RHSA-2026:55423 Released 2026-08-17 · Red Hat rating Important
    389-ds-base security update
    • Red Hat Enterprise Linux AppStream (v. 9) 389-ds-base-2.8.0-9.el9_8, 389-ds-base-libs-2.8.0-9.el9_8, 389-ds-base-snmp-2.8.0-9.el9_8 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) 389-ds-base-devel-2.8.0-9.el9_8
  • RHSA-2026:55424 Released 2026-08-17 · Red Hat rating Important
    389-ds-base security update
    • Red Hat Enterprise Linux AppStream (v. 10) 389-ds-base-3.2.0-9.el10_2, 389-ds-base-libs-3.2.0-9.el10_2, 389-ds-base-snmp-3.2.0-9.el10_2 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) 389-ds-base-bdb-3.2.0-9.el10_2, 389-ds-base-devel-3.2.0-9.el10_2
  • RHSA-2026:55426 Released 2026-08-17 · Red Hat rating Important
    389-ds-base security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) 389-ds-base-devel-2.6.1-23.el9_6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) 389-ds-base-2.6.1-23.el9_6, 389-ds-base-libs-2.6.1-23.el9_6, 389-ds-base-snmp-2.6.1-23.el9_6 +1
  • RHSA-2026:55422 Released 2026-08-17 · Red Hat rating Important
    389-ds-base security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) 389-ds-base-2.4.5-27.el9_4, 389-ds-base-libs-2.4.5-27.el9_4, python3-lib389-2.4.5-27.el9_4
  • RHSA-2026:55425 Released 2026-08-17 · Red Hat rating Important
    389-ds-base security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) 389-ds-base-3.0.6-20.el10_0, 389-ds-base-libs-3.0.6-20.el10_0, 389-ds-base-snmp-3.0.6-20.el10_0 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) 389-ds-base-bdb-3.0.6-20.el10_0, 389-ds-base-devel-3.0.6-20.el10_0
  • RHSA-2026:55421 Released 2026-08-17 · Red Hat rating Important
    389-ds-base security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) 389-ds-base-2.2.4-20.el9_2, 389-ds-base-libs-2.2.4-20.el9_2, python3-lib389-2.2.4-20.el9_2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Directory Server 12AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:55426
Red Hat Directory Server 11.5 E4S for RHEL 8Fixed RHSA-2026:79217
Red Hat Directory Server 11.7 E4S for RHEL 8Fixed RHSA-2026:56047
Red Hat Directory Server 11.9 for RHEL 8Fixed RHSA-2026:55532
Red Hat Directory Server 12.2 E4S for RHEL 9Fixed RHSA-2026:56048
Red Hat Directory Server 12.4 E4S for RHEL 9Fixed RHSA-2026:56050
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:55424
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:55530
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:55423
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:55757
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:55756
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:55794
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:55421
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:55422
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:55425
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:55426
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:55757
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:55756
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:55794
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:55424
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:55423
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:55425
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:55758
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:55758
Not affected: 1 product
  • Red Hat Directory Server 13

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15722
  2. 2026-10-03 Alias added: GHSA-5gg4-m865-6qwr
  3. 2026-10-08 Fix available: redhat-ds:[email protected] · CNA
  4. 2026-10-08 1 new reference · CNA
  5. 2026-10-09 Fix available: RHSA-2026:79217 · Red Hat
  6. 2026-10-09 Fix available: Red Hat Directory Server 11.5 E4S for RHEL 8 · Red Hat

References

Advisory 18

  • TI-2026-07965 Resource allocation without limits in 389-ds-base CVSS 3.1HIGH 7.5
  • TI-2026-10157 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check CVSS 3.1HIGH 7.5
  • TI-2024-05784 389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request CVSS 3.1MEDIUM 6.5
  • TI-2022-01808 Authorization bypass in 389-ds-base CVSS 3.1HIGH 7.5
  • TI-2010-02131 NULL pointer dereference in Red Hat Directory Server CVSS 3.1HIGH 7.5
  • TI-2026-10175 389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser CVSS 3.1HIGH 7.5
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences