CVE-2026-15722 Memory corruption in Red Hat Directory Server 11.5 E4S for RHEL 8
Remote unauthenticated attackers can crash the LDAP server via a stack buffer overflow in replica ID parsing, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-15722?
CVE-2026-15722 is a high-severity memory corruption vulnerability in Redhat Enterprise Linux, published on 31 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.
Weakness: CWE-121
Which versions are affected by CVE-2026-15722?
It affects 3 products.
Products include Redhat 389 Directory Server, Redhat Directory Server, Redhat Enterprise Linux.
How do I fix CVE-2026-15722?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-15722 being exploited?
There is no known exploitation of CVE-2026-15722 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check
- CVE-2026-9064 Denial of service in Red Hat Directory Server 11.5 E4S for RHEL 8
- CVE-2010-2222 Null dereference in Red Hat Directory Server
- CVE-2026-11611 389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions
- CVE-2024-6237 389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request
Sources
Also known as AZL-94362, CLSA-2026-1787755227, DEBIAN-CVE-2026-15722, GHSA-5gg4-m865-6qwr, UBUNTU-CVE-2026-15722.