A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b16c9cbc0f advisory.

    - Resolves: rhbz#2492927 CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length     bypasses size limit leading to heap buffer overflow [fedora-all]
    - Resolves: rhbz#2497652 CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv()     via padded SASL UNBIND [fedora-all]
    - Resolves: rhbz#2511796 CVE-2026-69152 389-ds-base: brace-expansion: Denial of Service via unbounded     intermediate arrays [fedora-all]
    - Resolves: rhbz#2529450 CVE-2026-76560 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI     bind-rule checks via empty bind DN [fedora-all]
    - Resolves: rhbz#2529451 CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication NULL pointer     dereference via paged results and USE_ONE_BACKEND control in op_shared_search [fedora-all]
    - Resolves: rhbz#2529452 CVE-2026-18355 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-     record length lower-bound underflow in sasl_io_start_packet() [fedora-all]
    - Resolves: rhbz#2494775 CVE-2026-11611 389-ds-base: 389-ds-base: Content Sync plugin unbounded queue     growth and race conditions [fedora-all]
    - Resolves: rhbz#2494825 CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema     objectclass serialization due to missing oc_superior in size calculation [fedora-all]
    - Resolves: rhbz#2494894 CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded     iteration count denial of service [fedora-all]
    - Resolves: rhbz#2494895 CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length     integer underflow crash [fedora-all]
    - Resolves: rhbz#2509729 CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in     CleanAllRUV status check [fedora-all]
    - Resolves: rhbz#2513063 CVE-2026-19404 389-ds-base: 389-ds-base: missing authorization allows anonymous     clients to start or abort CleanAllRUV replication maintenance [fedora-all]
    - Resolves: rhbz#2494827 CVE-2026-11793 389-ds-base: 389-ds-base: stack buffer overflow in checkPrefix()     algorithm ID parsing [fedora-all]
    - Resolves: rhbz#2494830 CVE-2026-11792 389-ds-base: 389-ds-base: heap buffer overflow in audit log     password masking (create_masked_entry_string) [fedora-all]
    - Resolves: rhbz#2498023 CVE-2026-15041 389-ds-base: 389-ds-base: Non-constant-time comparison in     PBKDF2-SHA256 password verification [fedora-all]



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0b8bc362b1 advisory.

    - Resolves: rhbz#2492927 CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length     bypasses size limit leading to heap buffer overflow [fedora-all]
    - Resolves: rhbz#2497652 CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv()     via padded SASL UNBIND [fedora-all]
    - Resolves: rhbz#2511796 CVE-2026-69152 389-ds-base: brace-expansion: Denial of Service via unbounded     intermediate arrays [fedora-all]
    - Resolves: rhbz#2529450 CVE-2026-76560 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI     bind-rule checks via empty bind DN [fedora-all]
    - Resolves: rhbz#2529451 CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication NULL pointer     dereference via paged results and USE_ONE_BACKEND control in op_shared_search [fedora-all]
    - Resolves: rhbz#2529452 CVE-2026-18355 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-     record length lower-bound underflow in sasl_io_start_packet() [fedora-all]
    - Resolves: rhbz#2494775 CVE-2026-11611 389-ds-base: 389-ds-base: Content Sync plugin unbounded queue     growth and race conditions [fedora-all]
    - Resolves: rhbz#2494825 CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema     objectclass serialization due to missing oc_superior in size calculation [fedora-all]
    - Resolves: rhbz#2494894 CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded     iteration count denial of service [fedora-all]
    - Resolves: rhbz#2494895 CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length     integer underflow crash [fedora-all]
    - Resolves: rhbz#2509729 CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in     CleanAllRUV status check [fedora-all]
    - Resolves: rhbz#2513063 CVE-2026-19404 389-ds-base: 389-ds-base: missing authorization allows anonymous     clients to start or abort CleanAllRUV replication maintenance [fedora-all]
    - Resolves: rhbz#2494827 CVE-2026-11793 389-ds-base: 389-ds-base: stack buffer overflow in checkPrefix()     algorithm ID parsing [fedora-all]
    - Resolves: rhbz#2494830 CVE-2026-11792 389-ds-base: 389-ds-base: heap buffer overflow in audit log     password masking (create_masked_entry_string) [fedora-all]
    - Resolves: rhbz#2498023 CVE-2026-15041 389-ds-base: 389-ds-base: Non-constant-time comparison in     PBKDF2-SHA256 password verification [fedora-all]


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c1e25a4642 advisory.

    - Resolves: rhbz#2492927 CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length     bypasses size limit leading to heap buffer overflow [fedora-all]
    - Resolves: rhbz#2497652 CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv()     via padded SASL UNBIND [fedora-all]
    - Resolves: rhbz#2511796 CVE-2026-69152 389-ds-base: brace-expansion: Denial of Service via unbounded     intermediate arrays [fedora-all]
    - Resolves: rhbz#2529450 CVE-2026-76560 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI     bind-rule checks via empty bind DN [fedora-all]
    - Resolves: rhbz#2529451 CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication NULL pointer     dereference via paged results and USE_ONE_BACKEND control in op_shared_search [fedora-all]
    - Resolves: rhbz#2529452 CVE-2026-18355 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-     record length lower-bound underflow in sasl_io_start_packet() [fedora-all]
    - Resolves: rhbz#2494775 CVE-2026-11611 389-ds-base: 389-ds-base: Content Sync plugin unbounded queue     growth and race conditions [fedora-all]
    - Resolves: rhbz#2494825 CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema     objectclass serialization due to missing oc_superior in size calculation [fedora-all]
    - Resolves: rhbz#2494894 CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded     iteration count denial of service [fedora-all]
    - Resolves: rhbz#2494895 CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length     integer underflow crash [fedora-all]
    - Resolves: rhbz#2509729 CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in     CleanAllRUV status check [fedora-all]
    - Resolves: rhbz#2513063 CVE-2026-19404 389-ds-base: 389-ds-base: missing authorization allows anonymous     clients to start or abort CleanAllRUV replication maintenance [fedora-all]
    - Resolves: rhbz#2494827 CVE-2026-11793 389-ds-base: 389-ds-base: stack buffer overflow in checkPrefix()     algorithm ID parsing [fedora-all]
    - Resolves: rhbz#2494830 CVE-2026-11792 389-ds-base: 389-ds-base: heap buffer overflow in audit log     password masking (create_masked_entry_string) [fedora-all]
    - Resolves: rhbz#2498023 CVE-2026-15041 389-ds-base: 389-ds-base: Non-constant-time comparison in     PBKDF2-SHA256 password verification [fedora-all]


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard     memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker     could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though     practical exploitation is extremely difficult due to PBKDF2 computational overhead. (CVE-2026-15041)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
350086	Fedora 44 : 389-ds-base (2026-b16c9cbc0f)	Nessus	Fedora Local Security Checks	Local	medium
349931	Fedora 43 : 389-ds-base (2026-0b8bc362b1)	Nessus	Fedora Local Security Checks	Local	medium
349930	Fedora 45 : 389-ds-base (2026-c1e25a4642)	Nessus	Fedora Local Security Checks	Local	medium
325686	Linux Distros Unpatched Vulnerability : CVE-2026-15041	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-15041

low

Tenable Plugins

medium

medium

medium

low