Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach LDAP replication port
  2. Delivery
    Send StartNSDS50ReplicationRequest with oversized replica ID
  3. Exploit
    Overflow 16-byte RUV stack buffer
  4. Execution
    Stack canary aborts ns-slapd
  5. Impact
    Directory service denial of service

Vulnerability Assessment

Weakness
CWE
CWE-121
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires network reachability to the 389 Directory Server LDAP endpoint and the ability to send a StartNSDS50ReplicationRequest extended operation containing an RUV element whose replica ID field exceeds 16 digit characters; the vulnerable get_ruvelement_from_berval() copy runs during payload decoding before authorization, so no bind credentials are needed (PR:N, AV:N/AC:L). The practical limiting factor is exposure of the replication service: deployments that firewall the LDAP/replication port to trusted replica peers, or that do not expose the server to untrusted networks, sharply reduce reachability. Stack protectors further limit the outcome to denial of service, preventing this from escalating to code execution or data compromise.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: network-reachable, low complexity, no privileges or user interaction, and pure availability impact - the confidentiality and integrity scores of N correctly reflect that stack canaries reduce this to a crash, not RCE. Real-world priority is moderate-to-high for exposed directory servers: the pre-authentication reachability and trivial trigger (a single oversized replica ID field) make reliable DoS practical, but impact is bounded to service disruption. No EPSS score, KEV listing, or POC was provided, so exploitation probability cannot be quantified from the input; the absence of KEV/POC signals suggests no confirmed in-the-wild use yet. The main mitigating factor is exposure scope - servers that restrict the replication endpoint to trusted replica peers are far less exposed than those reachable from untrusted networks.
Exploit ScenarioDerived

An attacker who can reach the directory server's LDAP port sends an anonymous StartNSDS50ReplicationRequest extended operation whose RUV element carries a replica ID field of more than 16 digit characters. The oversized copy overruns the 16-byte stack buffer in get_ruvelement_from_berval(), the stack protector detects corruption, and ns-slapd aborts - taking down authentication and directory services for all dependent applications. No exploit code is publicly identified, but the low-complexity, pre-auth trigger makes a working crash script straightforward to develop.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 31, 2026

Remote unauthenticated denial of service in 389 Directory Server (389-ds-base, shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) allows an attacker to crash the LDAP daemon by sending a crafted replication extended operation. The flaw is a stack buffer overflow in the RUV parsing path that triggers during payload decoding before any authorization check, so no credentials are needed. No public exploit identified at time of analysis; stack protectors constrain the outcome to a server crash rather than code execution.

RemediationAI

No exact vendor-released fix version is present in the supplied data, so track and apply the Red Hat errata referenced at https://access.redhat.com/security/cve/CVE-2026-15722 (and the upstream 389-ds-base fix bounding the replica ID copy) as soon as they are published for your RHEL/RHDS version. As a compensating control until patched, restrict network access to the LDAP replication service so that only known replica peers can send StartNSDS50ReplicationRequest operations - enforce this with host firewall rules or network ACLs on the LDAP/LDAPS ports, which is low-risk for standalone directories but will break replication if a legitimate supplier/consumer is inadvertently blocked. Where multi-master replication is not used, ensure the replication plugin/agreement is not enabled to remove the vulnerable code path. Monitor the ns-slapd process for unexpected restarts as a detection signal, and follow the Bugzilla entry (https://bugzilla.redhat.com/show_bug.cgi?id=2499961) for the confirmed patched versions.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

389 Directory Server is an enterprise LDAP directory used for identity and authentication services and is the directory backend for products such as Red Hat Identity Management/FreeIPA. The vulnerability lives in the multi-master replication subsystem: get_ruvelement_from_berval() in repl5_ruv.c parses a Replica Update Vector (RUV) element supplied inside a StartNSDS50ReplicationRequest extended operation. The function copies digit characters representing the replica ID from a network-supplied berval into a fixed 16-byte stack buffer without validating the input length, matching CWE-121 (Stack-based Buffer Overflow). Because RUV/berval decoding happens early in request handling, the copy executes before the server enforces bind/authorization, exposing the code path to anonymous clients that can reach the LDAP replication port.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Pre-auth network trigger with a trivial oversized field gives AV:N/AC:L/PR:N/UI:N; stack canaries bound impact to a crash, so C:N/I:N and A:H only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.

Executive ViewAI

Why It Matters

CVE-2026-15722 exposes Red Hat Directory Server and LDAP services on RHEL 6-10 to remote, unauthenticated denial of service attacks that can crash the directory daemon and disrupt authentication services across dependent infrastructure. Any internet-exposed or untrusted-network-accessible directory service is immediately at risk of service disruption. With no patch currently available, immediate defensive controls and monitoring are critical to prevent cascading authentication failures.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Implement network segmentation to restrict LDAP replication extended operations to authenticated internal systems only, enable LDAP service logging and daemon crash monitoring, configure automated failover to alternate directory servers, limit replication traffic by rate limiting at the firewall layer, and prepare documented recovery procedures including directory service restart protocols.

Threat Intelligence Overview

EPSS Score
0.5%
Top 59% exploitable
Prevalence
Medium
enterprise LDAP backend for Red Hat IdM/FreeIPA, common but not universal
Social Media
2
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.5%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_directory_server_11:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_directory_server_12:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_directory_server_13:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-15722 ADVISORY https://vuldb.com/vuln/385059 REF https://access.redhat.com/errata/RHSA-2026:55421 REF https://access.redhat.com/errata/RHSA-2026:55422 REF https://access.redhat.com/errata/RHSA-2026:55423 REF https://access.redhat.com/errata/RHSA-2026:55424 REF https://access.redhat.com/errata/RHSA-2026:55425 REF https://access.redhat.com/errata/RHSA-2026:55426 REF https://access.redhat.com/errata/RHSA-2026:55530 REF https://access.redhat.com/errata/RHSA-2026:55532 REF https://access.redhat.com/errata/RHSA-2026:55756 REF https://access.redhat.com/errata/RHSA-2026:55757 REF https://access.redhat.com/errata/RHSA-2026:55758 REF https://access.redhat.com/errata/RHSA-2026:55794 REF https://access.redhat.com/errata/RHSA-2026:56047 REF https://access.redhat.com/errata/RHSA-2026:56048 REF https://access.redhat.com/errata/RHSA-2026:56050 REF https://access.redhat.com/errata/RHSA-2026:79217 REF https://access.redhat.com/security/cve/CVE-2026-15722 REF https://bugzilla.redhat.com/show_bug.cgi?id=2499961

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy