Red Hat Directory Server/Enterprise Linux Replication repl5_ruv.c get_ruvelement_from_berval stack-based overflow

Summaryinfo

A vulnerability has been found in Red Hat Directory Server and Enterprise Linux and classified as critical. This issue affects the function get_ruvelement_from_berval of the file repl5_ruv.c of the component Replication. Performing a manipulation results in stack-based overflow. This vulnerability is cataloged as CVE-2026-15722. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in Red Hat Directory Server and Enterprise Linux (the affected version unknown). This affects the function get_ruvelement_from_berval of the file repl5_ruv.c of the component Replication. The manipulation with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on availability. The summary by CVE is:

A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.

It is possible to read the advisory at access.redhat.com. This vulnerability is uniquely identified as CVE-2026-15722 since 07/14/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 07/31/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-51509). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Directory Service Software

Vendor

• Red Hat

Name

• Directory Server
• Enterprise Linux

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion