REDHAT-BUG-2497697: Medium severity 389 Directory Server ns-slapd vulnerability

Published Jul 7, 2026

Updated

Valid heap-buffer-overflow in slapidnnormalizeext() -> sortrdnavs() -> rdnavswap() (ldap/servers/slapd/dn.c). Triggered when a DN contains a legacy-quoted value encoding a multivalued nested RDN. On closing quote, nested attribute-value tracking is not finalized; a subsequent separator can leave stale pointers that produce overlapping berval entries. In-place sorting then writes past the heap allocation in rdnavswap(). Reachable pre-auth via any LDAP operation whose DN is normalized (search base DN confirmed). Reproduced on RHEL 9.8 (389-ds-base-2.8.0-7.el98) with reporter PoC. Production behavior (no ASAN/MALLOCCHECK): malformed DN often returns err=34 (Invalid DN syntax); server continues. With MALLOCCHECK=3: general protection fault in libc, ns-slapd terminates.

Affected Software

1 affected component

389 Directory Server ns-slapd=2.8.0-7.el9_8

Event History

Jul 7, 2026

Data Sourced

via Red Hat·12:35 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2497697?

The severity of REDHAT-BUG-2497697 is classified as medium.

What causes the vulnerability REDHAT-BUG-2497697?

REDHAT-BUG-2497697 is caused by a valid heap-buffer-overflow in the slapi_dn_normalize_ext function when handling a DN with a legacy-quoted value.

How can I mitigate the risk associated with REDHAT-BUG-2497697?

To mitigate the risk of REDHAT-BUG-2497697, it is recommended to update to the latest version of 389 Directory Server.

What impact does REDHAT-BUG-2497697 have on 389 Directory Server?

The impact of REDHAT-BUG-2497697 includes potential crashes or unexpected behavior in 389 Directory Server when processing specific DN formats.

What should I do if I am affected by REDHAT-BUG-2497697?

If affected by REDHAT-BUG-2497697, you should apply the security patches provided by Red Hat for 389 Directory Server.