1. Home
  2. CVE Database
  3. CVE-2026-15041
LOW · 3.7

CVE-2026-15041

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote...

Vulnerability Description

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.

CVSS Score

3.7

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
RedhatDirectory Server11.0
Redhat389 Directory Server-
RedhatEnterprise Linux7.0

Related Weaknesses (CWE)

CWE-208

References

FAQ

What is CVE-2026-15041?

CVE-2026-15041 is a vulnerability with a CVSS score of 3.7 (LOW). A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote...

How severe is CVE-2026-15041?

CVE-2026-15041 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-15041?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Directory Server, Redhat 389 Directory Server, Redhat Enterprise Linux.