VULNERABILITY INTELLIGENCE

CVE-2026-15041

CVSS score3.7 LOW
EPSS probability0.36%
CISA KEVNot currently listed
Published2026-07-08
Last modified2026-07-09
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.

Weakness classification

  • secalert@redhat.com: CWE-208

Primary references