CVE-2026-102731

Apache Directory LDAP API versions 1.2.0 before 1.2.9 contain a memory-allocation flaw (CWE-789) in BER decoding: a size value in a small BER-encoded LDAP message is trusted and a large buffer is allocated before any corresponding data is received. A malicious peer, or an attacker in a man-in-the-middle position, can trigger an OutOfMemoryError that bypasses DecoderException handlers, or pin a huge allocation per connection while stalling, so a handful of connections can exhaust the JVM heap and cause denial of service. The same crafted bytes from an unauthenticated pre-bind client affect any embedding server that did not set MAX_PDU_SIZE_ATTR. Java applications and products that embed the affected library versions are impacted; CVSS has not yet been scored. No public proof of concept is known and the issue is not in CISA KEV.

What to do: Upgrade Apache Directory LDAP API to 1.2.9. Embedding servers that cannot upgrade immediately should set MAX_PDU_SIZE_ATTR so an unauthenticated pre-bind client cannot force an oversized allocation, and LDAP clients should be treated as vulnerable to heap exhaustion from a malicious peer or a man-in-the-middle until the fixed library is in use.