Description
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.



A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers.



This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.



Users are recommended to upgrade to version 2.1.9, which fixes the issue.
Published: 2026-10-02
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service via CPU exhaustion
Action: Immediate Patch
AI Analysis

Impact

The Apache Directory LDAP API contains an asymmetrical resource consumption vulnerability that can lead to a denial of service. When an LDAP server processes specially crafted telephone numbers, the API may exhaust a CPU core indefinitely. This results in a loss of service for legitimate clients, while confidentiality and integrity remain unchanged.

Affected Systems

The vulnerability is present in Apache Directory LDAP API versions 2.1.0 through 2.1.8. Any LDAP server, such as Apache Directory Server, that relies on this API falls within the affected scope.

Risk and Exploitability

The CVSS and EPSS metrics are not reported, but the impact of consuming 100% of a CPU core indefinitely is severe. The flaw is triggered by remote LDAP requests, so an attacker can induce the denial of service over the network. No public exploit has been documented and the vulnerability is not listed in CISA KEV, yet the lack of a fix can enable sustained service disruption.

Generated by OpenCVE AI on October 2, 2026 at 11:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache Directory LDAP API to version 2.1.9 or newer.
  • Implement input validation to ensure telephone number values conform to expected formats before they reach the LDAP API.
  • Configure the LDAP server to restrict CPU usage or apply throttling mechanisms to limit the impact of malformed requests.

Generated by OpenCVE AI on October 2, 2026 at 11:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache directory Ldap Api
Vendors & Products Apache
Apache directory Ldap Api

Fri, 02 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Fri, 02 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Description Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9, which fixes the issue.
Title Apache Directory LDAP API: Denial of service via crafted telephone number values
References

Subscriptions

Apache Directory Ldap Api
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-02T10:09:51.901Z

Reserved: 2026-10-01T13:23:38.750Z

Link: CVE-2026-103885

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-02T10:17:06.833

Modified: 2026-10-02T14:30:28.440

Link: CVE-2026-103885

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T14:44:50Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption