PT-2026-56392 · Unknown · 389 Directory Server

Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-15041

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions 389 Directory Server (affected versions not specified)

Description The PBKDF2-SHA256 password verification function uses the standard memcmp() function for comparing password hashes rather than a constant-time comparison function. This allows a remote attacker to potentially infer partial hash information by analyzing timing measurements of LDAP bind attempts. However, the computational overhead of PBKDF2 makes practical exploitation extremely difficult.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2026-15041

Affected Products

389 Directory Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-15041 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2498022 · Note
• https://twitter.com/CVEnew/status/2074825573247922662 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2026-15041 · Note