Bug 2506102 (CVE-2026-16560)

Summary: CVE-2026-16560 389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued RDN
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aadhikar, bsmejkal, jachapma, mreynolds, progier, rhel-process-autobot, snegrini, spichugi, tbordaz, vashirov, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-22 12:29:41 UTC 
By using a multivalued nested RDN (e.g. attr: "cn=a+sn=b",dc=com" through function slapi_dn_normalize_ext(), an attacker is able to overruns the destination buffer of this function. Inside INQUOTEDVALUE, the parser tracks the nested AVs in subrdn_avs[] keyed by subtypestart. On the closing '"' the state
moves to B4SEPARATOR without finalizing that tracking. The next
outer separator then calls add_rdn_av(subtypestart, d, ...) with a
stale subtypestart and an advanced d, producing a berval that
overlaps a previously stored one. sort_rdn_avs() bubble-sorts these
entries; rdn_av_swap()'s in-place swap assumes "av1 immediately
precedes av2", and the overlap turns its memcpy into an
out-of-bounds write past the dest buffer