The Apache Directory LDAP API has an asymmetric resource consumption flaw (CWE‑835) that can cause the API to consume 100 % of a CPU core indefinitely when processing certain malformed telephone number values. This flaw also falls under CWE‑400, amplifying the severity. The resulting denial of service impacts the LDAP server’s availability but does not alter data confidentiality or integrity.

Apache Directory LDAP API versions 2.1.0 through 2.1.8 are affected. LDAP servers that use this API – for example, Apache Directory Server – are also impacted.

The CVSS score of 7.5 indicates medium‑to‑high severity. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. The likely attack vector – based on the description – is a remote LDAP request that contains malicious telephone number data, although the CVE does not explicitly state the network entry point. No public exploit has been reported, but the simplicity of sending malformed values means an attacker could readily trigger sustained denial of service.