Stack Buffer Overflow in 389 Directory Server RUV Parsing

CVE-2026-15722 is a stack buffer overflow vulnerability in 389 Directory Server's replica update vector (RUV) parsing logic. The vulnerability exists in the get_ruvelement_from_berval() function, which fails to validate the length of digit characters copied from network-supplied data into a fixed 16-byte stack buffer. Remote unauthenticated attackers can exploit this by sending a malicious StartNSDS50ReplicationRequest extended operation with an oversized replica ID field, causing the server to crash and resulting in denial of service. This affects organizations running 389-ds-base as their LDAP directory infrastructure, potentially disrupting authentication and directory services for dependent applications.

While this CVE currently maps to zero Casky skills due to the absence of MITRE ATT&CK technique associations, security practitioners using Casky would typically identify similar memory corruption patterns through skills aligned with T1499 (Service Exhaustion Denial of Service) and T1190 (Exploit Public-Facing Application). When analyzing 389-ds-base deployments, practitioners should monitor for sudden replication service crashes, examine network traffic for malformed LDAP extended operations with unusually long replica ID fields, and review server logs for parsing errors during replication handshakes. Extended reasoning through Claude AI would help correlate raw packet data showing oversized berval structures with known vulnerable function signatures, enabling detection of exploitation attempts before successful denial of service occurs.