CVE-2026-103880: Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords
CVE-2026-103880 lets extreme bcrypt cost factors stall Apache Directory LDAP API servers for hours.
CVE-2026-103880 is an asymmetric resource-consumption bug in Apache Directory LDAP API 2.1.0 before 2.1.9. Storing a password hashed with bcrypt at a very high cost factor, such as 30, can make a supporting LDAP server use CPU for hours while checking credentials. Apache says a bounded cost should be enforced to avoid denial of service and rates the flaw important. Users should upgrade to 2.1.9; exploitation in the wild is not reported.
- CVE-2026-103880 affects Apache Directory LDAP API before 2.1.9.
- A bcrypt cost factor such as 30 can occupy CPU for hours.
- The issue is triggered when the server checks that stored password.
- Apache urges a bounded bcrypt cost and an upgrade to 2.1.9.
- CVEs
- CVE-2026-103880
- Vendors
- Apache Software Foundation
- Products
- Apache Directory LDAP API
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-103880 | DoS via excessive bcrypt cost in Apache Directory LDAP API | 7.5 | — |
From the original article
Posted by Emmanuel Lécharny on Oct 02 Severity: important Affected versions: - Apache Directory LDAP API 2. 1. 0 before 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.