CVE-2026-103880

Apache Directory LDAP API from 2.1.0 before 2.1.9 has an asymmetric resource consumption flaw (CWE-405) in bcrypt password handling. Storing a password with a very high bcrypt cost factor, such as 30, on an LDAP server that supports that algorithm causes credential checks to consume CPU for hours because no upper bound is enforced. The impact is denial of service against the server performing those checks, not remote code execution or data theft. Deployments of the affected API versions are impacted, including directory servers and applications that use the library for bcrypt verification. No public proof of concept is known, in-the-wild exploitation has not been reported, the issue is not in the CISA KEV catalog, and CVSS has not yet been scored.

What to do: Upgrade Apache Directory LDAP API to 2.1.9, which bounds bcrypt cost and fixes the issue. Until then, reject or cap bcrypt cost factors when passwords are stored and review existing hashes for unusually high cost values that could stall credential checks for hours.