A flaw was found in 389 Directory Server

Low3.7CVE-2026-15041 · Published Jul 8, 2026 · updated Jul 9, 2026

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.