CVE-2026-103885: Apache Directory LDAP API: Denial of service via crafted telephone number values
CVE-2026-103885 lets crafted telephone numbers pin a CPU core in Apache Directory LDAP API before 2.1.9.
38
CVE-2026-103885
CPU exhaustion DoS in Apache Directory LDAP API
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Directory LDAP API versions from 2.1.0 before 2.1.9 contain an asymmetric resource-consumption flaw in telephone-number handling. An LDAP server that uses the API, such as Apache DS, can be driven to use 100% of one CPU core indefinitely when it processes certain badly crafted telephone-number values. The impact is denial of service against availability, not described as code execution or data theft. Organizations running directory servers built on the affected API releases are exposed. The issue is not listed in CISA KEV, no public proof of concept is known, and CVSS has not yet been scored.
What to do: Upgrade Apache Directory LDAP API to 2.1.9 on every LDAP server that embeds it, including Apache DS. Until the upgrade is deployed, restrict untrusted LDAP writes or binds that can supply telephone-number attributes and watch for a single CPU core stuck at 100% while such values are processed.
| Product | Affected |
|---|---|
| Apache Software Foundation Apache Directory LDAP API | 2.1.0 before 2.1.9 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9, which fixes the issue.
- Weakness
- CWE-400
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H