CVE-2026-103552: Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder
Unbound clients can crash Apache Directory LDAP API before 1.2.9 with a deeply nested search filter.
Emmanuel Lécharny disclosed CVE-2026-103552, a stack-overflow denial-of-service flaw in Apache Directory LDAP API 1.2.0 before 1.2.9. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. The vendor rates the issue critical and recommends upgrading to 1.2.9. No in-the-wild exploitation is described.
- Affects Apache Directory LDAP API 1.2.0 before 1.2.9.
- An unbound client can send a deeply nested search filter.
- The nested filter overflows the stack in the server decoder.
- Version 1.2.9 fixes the issue; no exploitation is reported.
- CVEs
- CVE-2026-103552
- Vendors
- Apache Software Foundation
- Products
- Apache Directory LDAP API
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-103552 | Stack Overflow in Apache Directory LDAP API Before Bind | 7.3 | — |
From the original article
Posted by Emmanuel Lécharny on Oct 02 Severity: critical Affected versions: - Apache Directory LDAP API 1. 2. 0 before 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.