CVE-2026-102731: Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode
A tiny BER response can exhaust memory in Apache Directory LDAP API before 1.2.9, causing denial of service.
Emmanuel Lécharny disclosed CVE-2026-102731, an excessive memory-allocation flaw in Apache Directory LDAP API 1.2.0 before 1.2.9. A malicious peer or man-in-the-middle can send a small BER-encoded response that causes a large allocation before any data is received. The resulting OutOfMemoryError can take down the client JVM and cause denial of service. The vendor rates it critical, and no active exploitation is stated.
- Affects Apache Directory LDAP API 1.2.0 before 1.2.9.
- A small BER response can force a huge memory allocation before data arrives.
- A malicious peer or MITM can trigger OutOfMemoryError and denial of service.
- The client JVM is exhausted; exploitation is not reported.
- CVEs
- CVE-2026-102731
- Vendors
- Apache Software Foundation
- Products
- Apache Directory LDAP API
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102731 | Memory-exhaustion DoS in Apache Directory LDAP API | 7.5 | — |
From the original article
Posted by Emmanuel Lécharny on Oct 02 Severity: critical Affected versions: - Apache Directory LDAP API 1. 2. 0 before 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.