CVE-2026-16560 | A heap-buffer-overflow flaw was found in Directory Server (3… | CVSS 5.3 MEDIUM

Description

A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation.

Metadata

CVE ID: CVE-2026-16560
State: PUBLISHED
Assigner: redhat
Reserved: 2026-07-22 12:11 UTC
Published: 2026-07-22 12:51 UTC
Last updated: 2026-07-22 12:51 UTC
Primary CWE: CWE-1220
Insufficient Granularity of Access Control
Vendor / Product: Red Hat / Red Hat Directory Server 11
Sources: cve.org · NVD

Severity & Metrics

5.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products (8)

Vendor	Product	Platform	Versions
Red Hat	Red Hat Directory Server 11	—	—
Red Hat	Red Hat Directory Server 12	—	—
Red Hat	Red Hat Directory Server 13	—	—
Red Hat	Red Hat Enterprise Linux 10	—	—
Red Hat	Red Hat Enterprise Linux 6	—	—
Red Hat	Red Hat Enterprise Linux 7	—	—
Red Hat	Red Hat Enterprise Linux 8	—	—
Red Hat	Red Hat Enterprise Linux 9	—	—

Weakness (CWE)

CWE	Source	Description
CWE-1220	cna	Insufficient Granularity of Access Control

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References (2)