CVE-2026-15722 Details

A stack buffer overflow vulnerability has been identified in 389 Directory Server (389-ds-base) versions prior to 1.4. This issue arises in the 'get_ruvelement_from_berval()' function within 'repl5_ruv.c', where digit characters from a network-supplied RUV berval are copied into a fixed 16-byte stack buffer without proper bounds checking. This flaw allows remote, unauthenticated attackers to crash the LDAP server by sending a crafted 'StartNSDS50ReplicationRequest' extended operation with a replica ID field containing more than 16 digit characters. The overflow occurs during the decoding of the payload, before any authorization checks are applied, exploiting default configurations that permit anonymous access. Although stack protectors mitigate the risk of arbitrary code execution by aborting the process when a buffer overflow is detected, this vulnerability still leads to a denial-of-service condition by crashing the LDAP server.

Users can disable anonymous access by setting 'nsslapd-allow-anonymous-access' to 'off' or 'rootdse' in 'cn=config'. Alternatively, restrict network access to the LDAP port to trusted replication partners using firewall rules.