Red Hat Directory Server CVE-2026-16560

The target must be running a vulnerable version of 389-ds-base or Red Hat Directory Server with LDAP port 389 or 636 reachable by the attacker. The triggering condition is submission of an LDAP request containing a DN with a legacy-quoted value - this parsing path is active by default in affected versions with no non-default configuration flag required. No authentication is required per the CVSS PR:N metric, meaning anonymous LDAP access (if enabled) or pre-authentication request handling is sufficient. The primary factor limiting exploitation is network segmentation: if LDAP ports are firewalled to trusted hosts only, unauthenticated remote exploitation is prevented at the network layer. There is no indication in the available data that a specific Directory Server feature must be explicitly enabled beyond the default LDAP service configuration.

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, score 5.3 Medium) captures the unauthenticated network-accessible nature of the flaw but conservatively records I:N. The description explicitly names arbitrary memory write as a possible outcome alongside DoS, suggesting the integrity metric may be underweighted - a heap write primitive, even a coarse one, can serve as a stepping stone to code execution under favorable heap layout conditions. No EPSS score is available in the provided data, limiting probabilistic exploitation forecasting. This vulnerability is absent from CISA KEV and no public PoC has been identified, which meaningfully reduces near-term exploitation likelihood. Real-world risk is most acute for organizations exposing LDAP on untrusted network segments or permitting anonymous binds, as PR:N means no credential barrier exists. Enterprises that firewall LDAP to trusted hosts and require authenticated binds substantially reduce exposure. Overall, this is a genuine patching priority for internet-facing or anonymously accessible Directory Server instances, but not an emergency for well-segmented internal deployments.

An unauthenticated attacker with network access to the target's LDAP port (389 or 636) constructs an LDAP request containing a DN with a legacy-quoted attribute value and submits it to the Directory Server. The malformed DN triggers the heap allocation failure, and depending on runtime heap layout, the server process crashes (denial of service disrupting LDAP-dependent authentication and directory lookups) or the attacker achieves a write to an attacker-influenced memory region. No public PoC has been identified, but the low-complexity, no-authentication attack path means any network-adjacent host can attempt the trigger without tooling beyond a standard LDAP client.