CVE-2026-103885
published 2026-10-02CVE-2026-103885: Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.49%
41.0th percentile
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.
A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers.
This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.
Users are recommended to upgrade to version 2.1.9, which fixes the issue.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache_software_foundation | apache_directory_ldap_api | >= 2.1.0 < 2.1.9 | 2.1.9 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.apache.directory.api/api-ldap-model: Apache Directory LDAP API: Denial of Service via crafted telephone numbers
vendor_redhat·2026-10-02·CVSS 7.5
CVE-2026-103885 [HIGH] CWE-835 org.apache.directory.api/api-ldap-model: Apache Directory LDAP API: Denial of Service via crafted telephone numbers
org.apache.directory.api/api-ldap-model: Apache Directory LDAP API: Denial of Service via crafted telephone numbers
A flaw was found in Apache Directory LDAP API. This vulnerability allows an attacker to cause a Denial of Service (DoS) by submitting specially crafted telephone numbers to an LDAP (Lightweight Directory Access Protocol) server using the library. Processing these malformed inputs causes indefinite CPU core consumption, which can severely degrade performance or render directory services unresponsive.
Package: api-ldap-model (Red Hat Fuse 7) - Affected
GHSA
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.
ghsa_unreviewed·2026-10-02
CVE-2026-103885 Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.
A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers.
This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.
Users are recommended to upgrade to version 2.1.9, which fixes the issue.
No detection rules found.
No public exploits indexed.
2026-10-02
Published