The vulnerability CVE-2026-15722 affects the 389 Directory Server component of Red Hat Directory Server 11.9 for RHEL 8. It is a stack buffer overflow in the get_ruvelement_from_berval() function within repl5_ruv.c, where digit characters from a network-supplied RUV berval are copied into a fixed 16-byte stack buffer without bounds checking. This occurs during decoding of the StartNSDS50ReplicationRequest extended LDAP operation, before any authorization checks, allowing a remote unauthenticated attacker to crash the LDAP server by sending a replica ID field with more than 16 digit characters. Stack canaries and ASLR prevent code execution, limiting impact to denial of service. Mitigations include disabling anonymous LDAP access or restricting network access to trusted replication partners. Red Hat has released a security update (389-ds-base-2.2.4-20.el9_2) that fixes this issue.

The vulnerability allows a remote unauthenticated attacker to cause a denial of service by crashing the LDAP server process. There is no impact on confidentiality or integrity as exploitation is limited to denial of service due to stack protector and ASLR mitigations. The overflow occurs before authorization checks, so no credentials are required on default configurations with anonymous access enabled. Systems that restrict LDAP port access or disable anonymous access are not exposed to unauthenticated exploitation.

Red Hat has released an official security update that fixes this vulnerability; applying the update to 389-ds-base packages is the recommended remediation. Alternatively, administrators can mitigate risk by disabling anonymous LDAP access via setting nsslapd-allow-anonymous-access to 'off' or 'rootdse' in cn=config, or by restricting network access to the LDAP port to trusted replication partners using firewall rules. These mitigations reduce exposure until the patch is applied.