Six Apache Directory LDAP API flaws span 1.2 and 2.1

Six Apache Directory LDAP API flaws disclosed 2026-10-02 enable denial of service or potential code execution; fixes are 1.2.9 and 2.1.9.

Emmanuel Lécharny disclosed six Apache Directory LDAP API vulnerabilities on 2026-10-02, and none of the reports say exploitation has been observed. CVE-2026-102731 and CVE-2026-103552 affect 1.2.0 before 1.2.9 and are rated critical: a malicious peer or man-in-the-middle can exhaust the client JVM with a small BER response that allocates memory before data arrives, and an unbound client can crash the server decoder with a deeply nested search filter, which 1.2.9 fixes. CVE-2026-103877, in 2.1.0 before 2.1.9 and also rated critical, lets a rogue or compromised LDAP server or a pre-TLS man-in-the-middle answer loadSchema() with a schema object containing a serialized Java class that the client may load, with potential remote code execution. Three further issues in 2.1.0 before 2.1.9 are rated important and addressed by upgrading to 2.1.9: CVE-2026-103878 can expose plaintext if StartTLS follows a sent Search before the handshake finishes; CVE-2026-103880 can stall a server for hours while checking a bcrypt hash with a cost such as 30; and CVE-2026-103885 can pin one CPU core indefinitely on certain malformed telephone numbers, including on ApacheDS. The notices agree on affected ranges, severity, and the lack of reported exploitation; one spells the reporter’s surname without an accent.