CVE-2026-15041 389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification

Low 3.7 Published 8 Jul 2026 Updated 8 Jul 2026

Remote attackers can potentially infer partial password hash information via timing side-channels during LDAP bind attempts in 389 Directory Server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-15041?

CVE-2026-15041 is a low-severity vulnerability in Redhat Enterprise Linux, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.

Weakness: CWE-208

Which versions are affected by CVE-2026-15041?

It affects 3 products.

Products include Redhat 389 Directory Server, Redhat Directory Server, Redhat Enterprise Linux.

How do I fix CVE-2026-15041?

No fix has been published for CVE-2026-15041 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-15041 being exploited?

There is no known exploitation of CVE-2026-15041 in the wild and no public exploit code.

All Redhat Enterprise Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-15041, GHSA-j5fh-pqqw-m384, UBUNTU-CVE-2026-15041.