What is the CVSS score of CVE-2026-16560?

CVE-2026-16560 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.4%.

Red Hat Directory Server CVE-2026-16560

EUVD-2026-47661 MEDIUM

Insufficient Granularity of Access Control (CWE-1220)

2026-07-22 redhat

GHSA-cwj4-7fp9-r4jg

Denial Of Service Red Hat Directory Server 11 Red Hat Directory Server 12 Red Hat Directory Server 13 Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Suse

5.3

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

6.5 MEDIUM

AV:N and PR:N per LDAP exposure; I:L added because description explicitly cites arbitrary memory write as a possible outcome alongside DoS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 13:46 vuln.today

CVE Published

Jul 22, 2026 - 12:51 cve.org

MEDIUM 5.3

DescriptionCVE.org

A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation.

AnalysisAI

Heap buffer overflow in Red Hat Directory Server (389-ds-base) exposes LDAP services to remote unauthenticated denial of service or potential arbitrary memory write via malformed DN input. When a Distinguished Name containing a legacy-quoted value is processed, the server fails to close the associated heap allocation, permitting a subsequent operation to reference the same memory pointer - a classic heap confusion primitive. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Connect to LDAP port 389 or 636

Delivery

Submit LDAP request with legacy-quoted DN value

Exploit

Trigger heap allocation without proper closure in DN parser

Execution

Subsequent call dereferences stale heap pointer

Impact

Crash server process (DoS) or write to arbitrary memory location

Access

Connect to LDAP port 389 or 636

Delivery

Submit LDAP request with legacy-quoted DN value

Exploit

Trigger heap allocation without proper closure in DN parser

Execution

Subsequent call dereferences stale heap pointer

Impact

Crash server process (DoS) or write to arbitrary memory location

Vulnerability AssessmentAI

Exploitation	The target must be running a vulnerable version of 389-ds-base or Red Hat Directory Server with LDAP port 389 or 636 reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, score 5.3 Medium) captures the unauthenticated network-accessible nature of the flaw but conservatively records I:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker with network access to the target's LDAP port (389 or 636) constructs an LDAP request containing a DN with a legacy-quoted attribute value and submits it to the Directory Server. The malformed DN triggers the heap allocation failure, and depending on runtime heap layout, the server process crashes (denial of service disrupting LDAP-dependent authentication and directory lookups) or the attacker achieves a write to an attacker-influenced memory region. …
Remediation	Apply the vendor-supplied updated RPM for 389-ds-base as documented in the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-16560. … Detailed patch versions, workarounds, and compensating controls in full report.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Red Hat Directory Server 11

View all

CVE-2026-11610 HIGH This Week

8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD

CVE-2026-11774 HIGH This Week

7.6 Jun 11

Heap buffer overflow in 389 Directory Server (389-ds-base) SASL I/O layer allows authenticated remote attackers to crash

CVE-2026-11770 HIGH This Week

7.5 Jul 31

Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) le

CVE-2026-11788 HIGH This Week

7.5 Jun 09

Remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13 and Red Hat Enterprise Linux 6 throu

CVE-2026-15722 HIGH This Week

7.5 Jul 31

Remote unauthenticated denial of service in 389 Directory Server (389-ds-base, shipped as Red Hat Directory Server 11-13

CVE-2026-11789 MEDIUM This Month

6.5 Jun 09

Denial-of-service in Red Hat's 389 Directory Server allows a highly privileged network attacker to crash the LDAP servic

CVE-2026-11884 MEDIUM This Month

6.5 Jun 10

Heap buffer overflow in Red Hat 389 Directory Server allows an authenticated Directory Manager or a compromised replicat

CVE-2026-11611 MEDIUM This Month

6.5 Jun 08

Denial of service in Red Hat 389 Directory Server's Content Synchronization persistent search plugin enables authenticat

CVE-2026-11786 MEDIUM This Month

6.5 Jun 09

Out-of-bounds read in 389 Directory Server's LDIF parser exposes limited heap memory to a highly privileged local attack

CVE-2026-11787 MEDIUM This Month

6.3 Jun 09

Heap buffer over-read in Red Hat Directory Server's ldap_utf8prev() function exposes LDAP deployments to potential confi

CVE-2026-12528 MEDIUM This Month

5.4 Jun 17

Heap buffer overflow in 389 Directory Server's ACI parsing layer allows an authenticated LDAP user with write access to

CVE-2026-14940 MEDIUM This Month

5.3 Jul 07

Heap-buffer-overflow in 389 Directory Server's DN normalization routine allows an unauthenticated remote attacker to cor

Same weakness CWE-1220 – Insufficient Granularity of Access Control

View all

CVE-2026-33825 HIGH POC

7.8

CVE-2025-31201 CRITICAL POC

9.8

CVE-2026-56155 HIGH POC

7.8

CVE-2024-5389 HIGH POC

8.1

CVE-2024-8927 HIGH POC

7.5

CVE-2024-4147 MEDIUM POC

6.5

CVE-2024-6867 MEDIUM POC

6.5

CVE-2024-29200 MEDIUM POC

6.5

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Server 16.1	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected

CVE-2026-16560 vulnerability details – vuln.today

Back

Red Hat Directory Server CVE-2026-16560

Severity by source

CVSS VectorVendor: redhat

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

More in Red Hat Directory Server 11

Same weakness CWE-1220 – Insufficient Granularity of Access Control

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code