CVE-2026-15041
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In 389 Directory Server, the PBKDF2-SHA256 password verification function uses standard memcmp() instead of a constant-time comparison function. This allows a remote attacker to potentially infer partial hash information by measuring response times of LDAP bind requests.
Risk Assessment
The risk involves potential leakage of user password information, which could lead to data confidentiality breaches. However, practical exploitation is very difficult due to the computational overhead of PBKDF2.
Recommendation
It is recommended to update 389 Directory Server to a version that replaces memcmp() with a constant-time comparison function. Also monitor vendor announcements for specific patch details.
Original NVD description (English source)
A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.