VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Jul 7, 2026· Updated Jul 9, 2026

CVE-2026-14940

CVE-2026-14940

Description

A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name (RDN), the server can write past the end of a heap allocation while sorting RDN attribute-value pairs. An unauthenticated remote attacker can trigger this condition by sending an LDAP operation whose DN reaches the DN normalization routine, such as a search with a crafted base DN. This can corrupt heap memory and may cause denial of service.

Affected products

8
  • Red Hat/Directory Server4 versions
    cpe:2.3:a:redhat:directory_server:11.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:redhat:directory_server:11.0:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:directory_server:12.0:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:directory_server:13.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:389_directory_server:-:*:*:*:*:*:*:*
  • Red Hat/Enterprise Linux Server4 versions
    cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

2

News mentions

1