Skip to content
Red HatCVE-2026-16560

Red Hat Directory Server 11: denial of service

Medium5.3CVE-2026-16560 · Published Jul 22, 2026

A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation.

Red Hat advisory

Affected versions

PackageAffectedFixed in
Red Hat Directory Server 11
Product
all versionsNo fix yet
Red Hat Directory Server 12
Product
all versionsNo fix yet
Red Hat Directory Server 13
Product
all versionsNo fix yet
Red Hat Enterprise Linux 10
Product
all versionsNo fix yet
Red Hat Enterprise Linux 6
Product
all versionsNo fix yet
Red Hat Enterprise Linux 7
Product
all versionsNo fix yet
Red Hat Enterprise Linux 8
Product
all versionsNo fix yet
Red Hat Enterprise Linux 9
Product
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-1220

More Red Hat advisories

All Red Hat
Advisory
Red Hat librest: attacker could bypass PKCE protections
Medium6.8Jul 22
Red Hat Ansible Automation Platform 2: command injection
High7.8Jul 22
Red Hat Ansible Automation Platform 2: path traversal
Medium6.6Jul 22
Red Hat Ansible Automation Platform 2: information disclosure
Low3.3Jul 22
Red Hat Ansible Automation Platform 2: command injection
High7.8Jul 22
Red Hat Ansible Automation Platform 2: command injection
High7.8Jul 22

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.