CVE-2026-14940— 389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn
Quick assessment
Affected
Red Hat Red Hat Directory Server 11
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
389 Directory Server是389 Directory Server团队开源的一个高度可用、功能齐全、可靠和安全的LDAP服务器实现。 389 Directory Server存在缓冲区错误漏洞，该漏洞源于在标准化包含传统引号值编码的多值嵌套相对可分辨名称时，服务器在排序RDN属性值对时可能写入超出堆分配末尾（堆缓冲区溢出），导致破坏堆内存并可能造成拒绝服务。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Directory Server 11 | any |
affected |
| Red Hat | Red Hat Directory Server 12 | any |
affected |
| Red Hat | Red Hat Directory Server 13 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
unknown |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-14940
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn
Source: CVE Program / CVE List V5
Vulnerability Description
A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When
normalizing a Distinguished Name (DN) that contains a legacy-quoted value encoding a
multivalued nested Relative Distinguished Name (RDN), the server can write past the
end of a heap allocation while sorting RDN attribute-value pairs. An unauthenticated
remote attacker can trigger this condition by sending an LDAP operation whose DN
reaches the DN normalization routine, such as a search with a crafted base DN. This
can corrupt heap memory and may cause denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Vulnerability Title
389 Directory Server 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
389 Directory Server是389 Directory Server团队开源的一个高度可用、功能齐全、可靠和安全的LDAP服务器实现。 389 Directory Server存在缓冲区错误漏洞，该漏洞源于在标准化包含传统引号值编码的多值嵌套相对可分辨名称时，服务器在排序RDN属性值对时可能写入超出堆分配末尾（堆缓冲区溢出），导致破坏堆内存并可能造成拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Directory Server 11 | - |
cpe:/a:redhat:directory_server:11
|
|
| Red Hat | Red Hat Directory Server 12 | - |
cpe:/a:redhat:directory_server:12
|
|
| Red Hat | Red Hat Directory Server 13 | - |
cpe:/a:redhat:directory_server:13
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
II. Public POCs for CVE-2026-14940
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14940
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14940 (2)
Same Patch Batch · Red Hat · 2026-07-07 · 7 CVEs total
| CVE-2026-14474 | 8.8 HIGH | Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by defa |
| CVE-2026-14476 | 8.0 HIGH | Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authen |
| CVE-2026-58384 | 7.3 HIGH | Gimp: gimp: integer overflow in read_rle_channel() |
| CVE-2025-12799 | 6.5 MEDIUM | Jastow: jastow cross-site scripting attack due to unsanitized uri |
| CVE-2026-14969 | 4.4 MEDIUM | 389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encry |
| CVE-2026-14935 | 3.7 LOW | Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint |
IV. Related Vulnerabilities
Same product: Red Hat Directory Server 11
-
CVE-2026-18663
389-ds-base: 389-ds-base: pre-authentication double-free in -
CVE-2026-19404
389-ds-base: 389-ds-base: missing authorization allows anony -
CVE-2026-18651
389-ds-base: 389-ds-base: sasl plain bind installs connectio -
CVE-2026-16560
389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swa -
CVE-2026-15041
389-ds-base: 389-ds-base: non-constant-time comparison in pb
Same vendor: Red Hat
-
CVE-2026-95520
Rpm: rpm: integer overflow in iterreadarchivenext() leads to -
CVE-2026-102474
Dash: dash: heap out-of-bounds write in conv_escape via unde -
CVE-2026-102473
Dash: dash: super-polynomial backtracking in pmatch when lib -
CVE-2026-97029
Flatpak: flatpak: sandboxed app can signal unsandboxed proce -
CVE-2026-97024
Flatpak: flatpak: arbitrary write in root context via path t
V. Comments for CVE-2026-14940
No comments yet