CVE-2025-14905
Full vulnerability record from the local CVENow database.
Description
A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting characters. When a large number of aliases are processed, this oversight can lead to a heap overflow, potentially allowing a remote attacker to cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE).
Severity
HIGH
CVSS score
7.2
(v3.1)
Vulnerability status
Deferred
Source identifier
Published
2026-02-23 16:29:35.620000
Last modified
2026-11-05 15:17:11.863000
View original CVE JSON
{
"id": "CVE-2025-14905",
"sourceIdentifier": "[email protected]",
"published": "2026-02-23T16:29:35.620",
"lastModified": "2026-11-05T15:17:11.863",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting characters. When a large number of aliases are processed, this oversight can lead to a heap overflow, potentially allowing a remote attacker to cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE)."
},
{
"lang": "es",
"value": "Se encontró un defecto en el servidor 389-ds-base. Existe una vulnerabilidad de desbordamiento de búfer de montículo en la función 'schema_attr_enum_callback' dentro del archivo 'schema.c'. Esto ocurre porque el código calcula incorrectamente el tamaño del búfer al sumar las longitudes de las cadenas de alias sin tener en cuenta los caracteres de formato adicionales. Cuando se procesa un gran número de alias, este descuido puede conducir a un desbordamiento de montículo, lo que podría permitir a un atacante remoto causar una denegación de servicio (DoS) o lograr ejecución remota de código (RCE)."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Directory Server 11.5 E4S for RHEL 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "redhat-ds:11",
"cpes": [
"cpe:/a:redhat:directory_server_e4s:11.5::el8"
],
"versions": [
{
"version": "8060020260303152239.0ca98e7e",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Directory Server 11.7 E4S for RHEL 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "redhat-ds:11",
"cpes": [
"cpe:/a:redhat:directory_server_e4s:11.7::el8"
],
"versions": [
{
"version": "8080020260227193008.f969626e",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Directory Server 11.9 for RHEL 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "redhat-ds:11",
"cpes": [
"cpe:/a:redhat:directory_server:11.9::el8"
],
"versions": [
{
"version": "8100020260312105752.37ed7c03",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Directory Server 12.2 E4S for RHEL 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "redhat-ds:12",
"cpes": [
"cpe:/a:redhat:directory_server_e4s:12.2::el9"
],
"versions": [
{
"version": "9020020260304180546.1674d574",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Directory Server 12.4 EUS for RHEL 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "redhat-ds:12",
"cpes": [
"cpe:/a:redhat:directory_server_eus:12.4::el9"
],
"versions": [
{
"version": "9040020260225135630.1674d574",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds-base",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.1"
],
"versions": [
{
"version": "0:3.1.3-7.el10_1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds-base",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"versions": [
{
"version": "0:3.0.6-17.el10_0",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds-base",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"versions": [
{
"version": "0:1.3.11.1-11.el7_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds:1.4",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"versions": [
{
"version": "8100020260312103235.25e700aa",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds:1.4",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.2::appstream"
],
"versions": [
{
"version": "8020020260303204738.dbc46ba7",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds:1.4",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"versions": [
{
"version": "8040020260303172348.96015a92",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds:1.4",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"versions": [
{
"version": "8040020260303172348.96015a92",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds:1.4",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_e4s:8.6::appstream",
"cpe:/a:redhat:rhel_tus:8.6::appstream"
],
"versions": [
{
"version": "8060020260303144613.824efc52",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds:1.4",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_e4s:8.6::appstream",
"cpe:/a:redhat:rhel_tus:8.6::appstream"
],
"versions": [
{
"version": "8060020260303144613.824efc52",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds:1.4",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_e4s:8.6::appstream",
"cpe:/a:redhat:rhel_tus:8.6::appstream"
],
"versions": [
{
"version": "8060020260303144613.824efc52",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds:1.4",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"versions": [
{
"version": "8080020260227183930.6dbb3803",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds:1.4",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"versions": [
{
"version": "8080020260227183930.6dbb3803",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds-base",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"versions": [
{
"version": "0:2.7.0-10.el9_7",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds-base",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0::appstream"
],
"versions": [
{
"version": "0:2.0.14-5.el9_0",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds-base",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream"
],
"versions": [
{
"version": "0:2.2.4-17.el9_2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds-base",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4::appstream",
"cpe:/a:redhat:rhel_eus:9.4::crb"
],
"versions": [
{
"version": "0:2.4.5-24.el9_4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds-base",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6::appstream",
"cpe:/a:redhat:rhel_eus:9.6::crb"
],
"versions": [
{
"version": "0:2.6.1-20.el9_6",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Directory Server 13.1",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "dirsrv/dirsrv-container-rhel10",
"cpes": [
"cpe:/a:redhat:directory_server:13.1::el10"
],
"versions": [
{
"version": "1772040913",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Directory Server 12",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "redhat-ds:12/389-ds-base",
"cpes": [
"cpe:/a:redhat:directory_server:12"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Directory Server 13",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds-base",
"cpes": [
"cpe:/a:redhat:directory_server:13"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds-base",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-02-23T18:49:43.028074Z",
"id": "CVE-2025-14905",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-122"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:3189",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:3208",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:3379",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:3504",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:4207",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:4661",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:4720",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:5196",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:5511",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:5512",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:5513",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:5514",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:5568",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:5569",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:5576",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:5597",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:5598",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:6220",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:6268",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-14905",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423624",
"source": "[email protected]"
}
]
}