CVE-2026-15041 | BDVDB-2026-346134 Detail

Description#

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-08Record published in the CVE List.
2. Version 22026-11-06Most recent update recorded in the CVE List.