CVE-2026-15041: 389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification
A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function pbkdf2sha256pwcmp() in ldap/servers/plugins/pwdstorage/pbkdf2pwd.c uses standard memcmp() for hash comparison instead of the project's constant-time slapictmemcmp(). Every other password storage scheme in the same plugin uses slapictmemcmp(), which was introduced specifically to prevent timing side-channels (see CVE-2016-5405). This inconsistency allows a remote attacker with network access to the LDAP service to potentially infer partial hash information through repeated timing measurements of LDAP bind attempts. Practical exploitation is extremely difficult due to the PBKDF2 work factor (8192+ iterations, ~2ms computation time) which dominates and masks the nanosecond-level memcmp timing delta.
Other sources
A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15041?
The severity level of CVE-2026-15041 is classified as low, with a score of 3.7.
How do I fix CVE-2026-15041?
To fix CVE-2026-15041, you should update to the patched version of Red Hat 389 Directory Server that addresses this vulnerability.
What impact does CVE-2026-15041 have on password security?
CVE-2026-15041 introduces a risk of timing attacks during password verification, potentially compromising user passwords.
Which product is affected by CVE-2026-15041?
The affected product is the Red Hat 389 Directory Server.
Is CVE-2026-15041 exploitable remotely?
Yes, CVE-2026-15041 is exploitable remotely, as indicated by its attack vector classification.