CVE-2026-14940: 389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn
A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name (RDN), the server can write past the end of a heap allocation while sorting RDN attribute-value pairs. An unauthenticated remote attacker can trigger this condition by sending an LDAP operation whose DN reaches the DN normalization routine, such as a search with a crafted base DN. This can corrupt heap memory and may cause denial of service.
Other sources
Valid heap-buffer-overflow in slapidnnormalizeext() -> sortrdnavs() -> rdnavswap() (ldap/servers/slapd/dn.c). Triggered when a DN contains a legacy-quoted value encoding a multivalued nested RDN. On closing quote, nested attribute-value tracking is not finalized; a subsequent separator can leave stale pointers that produce overlapping berval entries. In-place sorting then writes past the heap allocation in rdnavswap(). Reachable pre-auth via any LDAP operation whose DN is normalized (search base DN confirmed). Reproduced on RHEL 9.8 (389-ds-base-2.8.0-7.el98) with reporter PoC. Production behavior (no ASAN/MALLOCCHECK): malformed DN often returns err=34 (Invalid DN syntax); server continues. With MALLOCCHECK=3: general protection fault in libc, ns-slapd terminates.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14940?
CVE-2026-14940 has a medium severity rating of 5.3.
How do I fix CVE-2026-14940?
To address CVE-2026-14940, update the 389 Directory Server to the latest version that includes the security patch.
What type of flaw is described in CVE-2026-14940?
CVE-2026-14940 is a heap-buffer-overflow flaw related to dn normalization in 389 Directory Server.
What is affected by CVE-2026-14940?
CVE-2026-14940 affects the 389 Directory Server software.
What conditions lead to CVE-2026-14940 being exploited?
CVE-2026-14940 can be exploited when normalizing a Distinguished Name with a legacy-quoted multivalued RDN.