CVE-2026-15722High· 7.5▾ TwilightA stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without b…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
0.5% → 0.9%
A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.
directory_server = 11.0directory_server = 12.0389_directory_serverenterprise_linux = 7.0enterprise_linux = 8.0enterprise_linux = 9.0enterprise_linux = 10.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-11788Medium· 5.9A flaw was found in 389 Directory Server
CVE-2026-18651Medium· 5.4A flaw was found in 389 Directory Server
CVE-2026-11793Medium· 4.9A stack buffer overflow flaw was found in 389 Directory Server
CVE-2025-6170Low· 2.5A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files
CVE-2026-48863High· 7.5A flaw was found in libsolv
CVE-2026-1761High· 8.6A flaw was found in libsoup