CVE-2026-78243: Apache YuniKorn: LDAP Group provider panics on lowercase attribute name
AI summary · grok-4.7Summaries by Vani AI
Apache YuniKorn's LDAP group resolver can panic on a lowercase memberOf attribute before version 1.10.0.
Apache YuniKorn 1.8.0 and later, before 1.10.0, can crash when the LDAP group resolver processes a group membership entry. An out-of-bounds read occurs if the LDAP server returns a memberOf attribute using a lowercase attribute name. CVE-2026-78243 is rated CVSS 4.0 2.1 (low), with low availability impact and high attack complexity. The fix is in version 1.10.0.
Key facts
- Affects YuniKorn 1.8.0 and later before 1.10.0 with LDAP groups enabled.
- An out-of-bounds read panics the scheduler on lowercase memberOf names.
- CVE-2026-78243 is CVSS 4.0 2.1 with low availability impact.
- Attack complexity is high and recovery effort is rated high.
- CVEs
- CVE-2026-78243
- Vendors
- Apache
- Products
- Apache YuniKorn
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-78243 | LDAP group resolver crash in Apache YuniKorn | 2.1 | — |
From the original article
Posted by Wilfred Spiegelenburg on Oct 07 Severity: CVSS 4. 0: 2. 1 (low) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.