CVE-2026-14940 — MEDIUM (5.3)

Vulnerability Description

A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name (RDN), the server can write past the end of a heap allocation while sorting RDN attribute-value pairs. An unauthenticated remote attacker can trigger this condition by sending an LDAP operation whose DN reaches the DN normalization routine, such as a search with a crafted base DN. This can corrupt heap memory and may cause denial of service.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

LOW

Affected Products

Vendor	Product	Versions
Redhat	Directory Server	11.0
Redhat	389 Directory Server	-
Redhat	Enterprise Linux	7.0

Related Weaknesses (CWE)

CWE-122

References

https://access.redhat.com/security/cve/CVE-2026-14940Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2497697Issue TrackingVendor Advisory

FAQ

What is CVE-2026-14940?

CVE-2026-14940 is a vulnerability with a CVSS score of 5.3 (MEDIUM). A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legacy-quoted value encoding a multivalued nested Relative Disti...

How severe is CVE-2026-14940?

CVE-2026-14940 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-14940?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Directory Server, Redhat 389 Directory Server, Redhat Enterprise Linux.