CVE-2026-103885: Apache Directory LDAP API: Denial of service via crafted telephone number values
CVE-2026-103885 lets crafted telephone numbers pin a CPU core in Apache Directory LDAP API before 2.1.9.
Emmanuel Lecharny disclosed CVE-2026-103885, an asymmetric resource-consumption flaw in Apache Directory LDAP API versions 2.1.0 before 2.1.9. An LDAP server using the API, such as ApacheDS, may consume 100 percent of a CPU core indefinitely while processing certain malformed telephone-number values. Apache rates the issue important and recommends upgrading to 2.1.9. No in-the-wild exploitation is reported.
- CVE-2026-103885 affects Apache Directory LDAP API 2.1.0 before 2.1.9.
- Crafted telephone numbers can pin one CPU core indefinitely.
- Servers using the API, including ApacheDS, are affected.
- Apache rates it important and recommends upgrading to 2.1.9.
- CVEs
- CVE-2026-103885
- Vendors
- Apache Software Foundation
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-103885 | CPU exhaustion DoS in Apache Directory LDAP API | 7.5 | — |
From the original article
Posted by Emmanuel Lécharny on Oct 02 Severity: important Affected versions: - Apache Directory LDAP API 2. 1. 0 before 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.