HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-15722 — A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). Th...

·Source: NIST NVD

Updated:

Executive Summary

A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a repl

Analysis

A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service. CVSS Score: 7.5. Published: 2026-07-31T10:16:44.863.

Indicators of Compromise (1)

CVE (1)
CVE-2026-15722
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 31, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

ISMG Editors: A New Front in the Naming War

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/ismg-editors-new-front-in-naming-war-image_small-7-a-32387.jpg" align=right hspace=4><b>Also: The AI Spending Reality Check, Nvidia Takes on Closed AI</b><br>In this week's panel, four ISMG editors discussed Google's controversial new threat actor naming system and the need for standardization, whether the artificial intelligence

Bank Info Security
MEDIUMVulnerabilityNEW

CISA warns of spike in attacks on water systems as Minnesota incidents probed

The Cybersecurity and Infrastructure Security Agency said in a public alert on Thursday that facilities should “remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible."

The Record
MEDIUMVulnerability

Hacker uses DeepSeek AI to autonomously attack vulnerable servers

A Chinese-speaking threat actor is using the DeepSeek AI model and the open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers with limited human involvement. [...]

BleepingComputer