From 1faf693b18c379faf509fd03224f1c9ffa4f34a5 Mon Sep 17 00:00:00 2001 From: Thierry Bordaz Date: Wed, 15 Jul 2026 11:39:58 +0200 Subject: [PATCH] Issue CVE-2026-15722 - pre-authentication stack buffer overflow Bug description: The function get_ruvelement_from_berval() in ldap/servers/plugins/replication/repl5_ruv.c parses a replica ID from a Replica Update Vector (RUV) berval by copying digit characters into a 16-byte stack buffer (ridbuff[RIDSTR_SIZE]). The copy loop has no bounds check it keeps writing as long as isdigit() returns true. A berval with more than 16 digit characters in the replica ID position overflows the buffer. Fix description: if the berval contains more than RIDSTR_SIZE-1 digits it fails fixes: TBD Reviewed by: Mark Reynolds --- ldap/servers/plugins/replication/repl5_ruv.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ldap/servers/plugins/replication/repl5_ruv.c b/ldap/servers/plugins/replication/repl5_ruv.c index fc74869dd..d4c6bbe94 100644 --- a/ldap/servers/plugins/replication/repl5_ruv.c +++ b/ldap/servers/plugins/replication/repl5_ruv.c @@ -1987,6 +1987,9 @@ get_ruvelement_from_berval(const struct berval *bval) /* replica id must be here */ i = 0; while (isdigit(bval->bv_val[urlbegin])) { + if (i >= RIDSTR_SIZE - 1) { + goto loser; + } ridbuff[i] = bval->bv_val[urlbegin]; i++; urlbegin++; -- 2.55.0