{"id":"CVE-2026-14940","title":"389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn","summary":"A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When\nnormalizing a Distinguished Name (DN) that contains a legacy-quoted value encoding a\nmultivalued nested Relative Distinguished Name (RDN), the server can w…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvssSource":"cna","cwe":["CWE-122"],"vendor":"Red Hat","product":"redhat-ds:11/389-ds-base","affected":["redhat-ds:11/389-ds-base (all versions)","redhat-ds:12/389-ds-base (all versions)","389-ds-base (all versions)","389-ds-base (all versions)","389-ds-base","389-ds-base (all versions)","389-ds:1.4/389-ds-base (all versions)","389-ds-base (all versions)"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-07-07T15:35:34.392277Z"},"published":"2026-07-07","updated":"2026-11-05","sourceUpdated":"2026-11-05T16:41:44.076Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-14940","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-14940"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497697","label":"RHBZ#2497697"}],"tags":["cve.org"],"epss":0.00487,"epssPercentile":0.42096,"ingestedAt":"2026-11-05T22:38:31.387Z","slug":"CVE-2026-14940","body":"## Overview\n\nA heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When\nnormalizing a Distinguished Name (DN) that contains a legacy-quoted value encoding a\nmultivalued nested Relative Distinguished Name (RDN), the server can write past the\nend of a heap allocation while sorting RDN attribute-value pairs. An unauthenticated\nremote attacker can trigger this condition by sending an LDAP operation whose DN\nreaches the DN normalization routine, such as a search with a crafted base DN. This\ncan corrupt heap memory and may cause denial of service.\n\n## Affected\n\n- `redhat-ds:11/389-ds-base (all versions)`\n- `redhat-ds:12/389-ds-base (all versions)`\n- `389-ds-base (all versions)`\n- `389-ds-base (all versions)`\n- `389-ds-base`\n- `389-ds-base (all versions)`\n- `389-ds:1.4/389-ds-base (all versions)`\n- `389-ds-base (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nMitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}