The flaw stems from 389 Directory Server’s PBKDF2‑SHA256 password verification, which uses the standard memcmp routine instead of a constant‑time comparison. This design flaw creates a timing side‑channel during LDAP bind attempts, allowing a remote attacker to observe response time differences and potentially deduce partial hash information. Although the theoretical exploitation path exists, the heavy computational load of PBKDF2 makes successful attacks extremely challenging in practice.

Red Hat Directory Server 11, 12, and 13, and all Red Hat Enterprise Linux packages that contain the Directory Server, including RHEL 6, 7, 8, 9, and the legacy RHEL 10, are impacted.

The recorded CVSS score is 3.7, indicating low overall severity. The EPSS score of less than 1 % suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector most likely involves remote LDAP bind traffic to the Directory Server, with an attacker measuring response times to attempt to deduce hash fragments. Because PBKDF2 introduces heavy computation, the feasibility of successful timing attacks remains low.