389 Directory Server EUVD-2026-42213

No authentication is required to initiate LDAP bind attempts (PR:N in CVSS). However, the attacker must have network-level access to the LDAP or LDAPS port (typically 389 or 636) of the target Directory Server. Exploitation is contingent on the server using PBKDF2-SHA256 as the active password storage scheme - this must be the configured scheme for the target user account. High attack complexity (AC:H) reflects that successful timing inference requires eliminating network jitter, issuing a very large number of bind probes, and applying statistical analysis to extract meaningful signal from PBKDF2-dominated response times. Account lockout policies, rate-limiting middleware, or TLS overhead on encrypted connections all further reduce the practical feasibility of this attack.

The CVSS 3.1 base score of 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects the constrained real-world risk. The high attack complexity (AC:H) directly encodes the statistical difficulty of extracting reliable timing signal from PBKDF2 hash comparisons across a noisy network path. Confidentiality impact is rated Low because only partial, probabilistic hash information is theoretically inferable - not plaintext passwords or full hashes. There is no KEV listing and no POC published, so this represents a theoretical cryptographic weakness rather than an operationally exploited flaw. EPSS data is not provided in the source intelligence; given the technical difficulty and absence of weaponized tooling, exploitation probability would be expected to be very low. The primary real-world risk is a sophisticated, patient adversary with many login attempts and low-latency network access to the LDAP service - a scenario that most LDAP deployments mitigate through rate-limiting or account lockout policies.

An attacker with direct network access to the LDAP port (389/636) submits thousands of bind requests for a known username with crafted passwords designed to produce hash prefixes of varying lengths, then uses statistical methods to measure sub-millisecond differences in server response times. Because PBKDF2 normalization dominates total response time, the attacker would need exceptionally precise timing measurements and a very high request volume to extract even partial hash information - no public exploit code currently demonstrates this attack.