Cyber Resilience

CVE-2026-15041

Redhat Enterprise Linux 10.0 … 9.0

Published
08 July 2026
Modified
09 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 3.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0030 22th percentile
Risk Priority 16 floored blend · peak EPSS

Summary

CVE-2026-15041 is a low-severity Observable Timing Discrepancy (CWE-208) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 3.7 (Low).

Operationally, ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-8 (Transmission Confidentiality and Integrity) and SC-13 (Cryptographic Protection) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer…

more

partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.

CWE(s)
CWE-208

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.
Confidence: LOW · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-11611Same product: Redhat 389 Directory Server
CVE-2024-6237Same product: Redhat 389 Directory Server
CVE-2026-11789Same product: Redhat 389 Directory Server
CVE-2026-11787Same product: Redhat 389 Directory Server
CVE-2026-9064Same product: Redhat 389 Directory Server
CVE-2026-14940Same product: Redhat 389 Directory Server
CVE-2026-11786Same product: Redhat 389 Directory Server
CVE-2026-12528Same product: Redhat 389 Directory Server
CVE-2026-11791Same product: Redhat 389 Directory Server
CVE-2026-11790Same product: Redhat 389 Directory Server

Affected Assets

redhat
directory server
11.0, 12.0, 13.0
redhat
389 directory server
all versions
redhat
enterprise linux
10.0, 7.0, 8.0, 9.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-8 Transmission Confidentiality and Integrity
  • SC-13 Cryptographic Protection
Detect
Catch it (NIST detect / respond)
  • SI-7 Software, Firmware, and Information Integrity
Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V11.2.4

Mitigating Controls (NIST 800-53 r5) AI

SC-8 Transmission Confidentiality and Integrity good match
prevent

SC-8 requires cryptographic protection of transmitted information, directly mitigating timing side-channel leakage of password hash material during LDAP bind operations over the network.

SC-13 Cryptographic Protection partial match
prevent

SC-13 mandates use of approved cryptographic modules and algorithms, which implicitly includes constant-time comparison primitives for sensitive operations such as password verification.

SI-7 Software, Firmware, and Information Integrity minimal match
detect

SI-7 enables integrity verification of software and firmware, allowing detection of the flawed memcmp() implementation in the 389 Directory Server binary.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require constant-time implementations that eliminate observable timing discrepancies.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.17 Clock synchronization none match
none

Consistent reference clocks limit the attacker's ability to measure or manipulate timing differences that could reveal internal state or processing paths.

References