CVE-2026-16560Medium· 5.3▾ SunlitA heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of s…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation.
redhat-ds:11/389-ds-base (all versions)redhat-ds:12/389-ds-base (all versions)389-ds-base (all versions)389-ds-base (all versions)389-ds-base (all versions)389-ds-base (all versions)389-ds-base (all versions)389-ds-base (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Denial of service is more reliably observed when heap debugging is enabled (for example AddressSanitizer or MALLOC_CHECK_=3), or depending on heap layout and subsequent memory allocator activity. For this reason Red Hat rates availability impact as Low (A:L) rather than High. There is no configuration switch to disable DN normalization for client-supplied DNs. The vulnerable code path is present in all currently supported 389-ds-base versions that ship the quoted-RDN parsing logic in dn.c.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-18663Medium· 5.9389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking control
CVE-2026-14969Medium· 4.4389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption
CVE-2026-14940Medium· 5.3389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn
CVE-2026-11884Medium· 6.5389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation
CVE-2026-11789Medium· 4.9389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash
CVE-2026-11790Medium· 4.9389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service