Vulnerability Details CVE-2026-15041
A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 21.8%
CVSS Severity
CVSS v3 Score 3.7
References
Products affected by CVE-2026-15041
-
cpe:2.3:a:redhat:directory_server:11.0
-
cpe:2.3:a:redhat:directory_server:12.0
-
cpe:2.3:a:redhat:directory_server:13.0
-
cpe:2.3:o:redhat:389_directory_server:-
-
cpe:2.3:o:redhat:enterprise_linux:10.0
-
cpe:2.3:o:redhat:enterprise_linux:7.0
-
cpe:2.3:o:redhat:enterprise_linux:8.0
-
cpe:2.3:o:redhat:enterprise_linux:9.0