CVE-2026-15722: 389 Directory Server DoS Vulnerability

CVE-2026-15722 Overview

CVE-2026-15722 is a stack buffer overflow vulnerability in the 389 Directory Server (389-ds-base), an enterprise Lightweight Directory Access Protocol (LDAP) server. The flaw resides in the get_ruvelement_from_berval() function inside repl5_ruv.c. The function copies digit characters from a network-supplied Replica Update Vector (RUV) berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation with a replica ID field containing more than 16 digit characters. The overflow triggers during payload decoding, before any authorization check. Stack protectors limit the impact to denial of service. The weakness is classified as [CWE-121] Stack-based Buffer Overflow.

Critical Impact
Unauthenticated remote attackers can crash the LDAP directory service by sending a single malformed replication extended operation, disrupting authentication and directory-dependent applications.

Affected Products

389 Directory Server (389-ds-base) — versions containing the vulnerable get_ruvelement_from_berval() implementation
Red Hat Directory Server distributions bundling affected 389-ds-base builds
Linux distributions shipping the affected 389-ds-base package

Discovery Timeline

2026-07-31 - CVE-2026-15722 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-15722

Vulnerability Analysis

The vulnerability sits in the replication code path of 389 Directory Server. When an LDAP client issues a StartNSDS50ReplicationRequest extended operation, the server decodes the attached berval payload to extract RUV elements. One of those elements is a replica ID represented as an ASCII digit sequence. The parsing routine get_ruvelement_from_berval() in repl5_ruv.c copies these digit characters into a 16-byte stack buffer. The routine performs no length validation against the destination buffer size. A payload containing more than 16 digit characters overruns the stack frame and corrupts adjacent memory, including saved return addresses and canary values.

Because the decoding occurs before the server evaluates authorization, an attacker does not need valid credentials or replication privileges. Compiler-inserted stack protectors detect the corruption and abort the process, which converts what could have been arbitrary code execution into a reliable denial-of-service condition. The impact is limited to availability, consistent with the CVSS vector's C:N/I:N/A:H profile.

Root Cause

The root cause is an unchecked copy into a fixed-size stack buffer. The parser trusts the length of the attacker-controlled digit run in the berval instead of enforcing the 16-byte destination bound. This is a classic [CWE-121] stack-based buffer overflow introduced by manual character-by-character copying without a matching bounds test.

Attack Vector

Exploitation requires only network access to the LDAP port and the ability to issue an extended operation. No authentication, user interaction, or elevated privileges are required. An attacker crafts a StartNSDS50ReplicationRequest where the replica ID field contains 17 or more digit characters, sends it to the target directory server, and the parsing routine overflows the stack buffer. Stack canaries trigger process termination, dropping the LDAP service.

For technical details, see the Red Hat CVE-2026-15722 Advisory and the Red Hat Bug Report #2499961.

Detection Methods for CVE-2026-15722

Indicators of Compromise

Unexpected termination of the ns-slapd process with stack-smashing messages such as *** stack smashing detected *** in system logs or journal output.
Core dumps generated by ns-slapd referencing get_ruvelement_from_berval or repl5_ruv.c in the stack trace.
LDAP access logs showing StartNSDS50ReplicationRequest extended operations (OID 2.16.840.1.113730.3.5.3) from unauthenticated or unexpected source addresses immediately before a service crash.

Detection Strategies

Monitor ns-slapd process lifecycle events and correlate abnormal exits with inbound LDAP extended operations from external or non-replication peer addresses.
Inspect LDAP protocol telemetry for StartNSDS50ReplicationRequest messages carrying replica ID fields with more than 16 digit characters.
Deploy network-based signatures on LDAP extended operation OID 2.16.840.1.113730.3.5.3 where the encoded replica ID length exceeds expected bounds.

Monitoring Recommendations

Alert on repeated LDAP service restarts, especially those correlated with new or unauthenticated source IPs.
Baseline legitimate replication peers and flag StartNSDS50ReplicationRequest traffic from any host outside that list.
Forward directory server audit and error logs to a centralized analytics platform for long-term correlation of crash patterns with upstream network events.

How to Mitigate CVE-2026-15722

Immediate Actions Required

Apply the vendor-supplied 389-ds-base update as soon as it is available from Red Hat or the relevant Linux distribution.
Restrict inbound LDAP access so that only known replication peers can issue extended operations on the replication port.
Segment directory servers into a management network and block untrusted sources from reaching ldap:// and ldaps:// listeners at the firewall.

Patch Information

Refer to the Red Hat CVE-2026-15722 Advisory and Red Hat Bug Report #2499961 for fixed package versions and errata. Update 389-ds-base through the distribution package manager once the patched build is published, and restart the dirsrv service to load the corrected binary.

Workarounds

Where patching is not immediately possible, use host firewalls or network ACLs to allow LDAP extended operations only from designated replication peers.
Disable multi-supplier replication temporarily if it is not required, which reduces the exposure of the StartNSDS50ReplicationRequest handler to untrusted sources.
Enforce mutual TLS on replication links and terminate connections that fail certificate validation before they reach the vulnerable parser.