Apache Software FoundationCVE-2026-103885

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API

UnratedCVE-2026-103885 · Published Oct 2, 2026

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9, which fixes the issue.

Apache Software Foundation advisory

Affected versions

Package	Affected	Fixed in
Apache Directory LDAP API Product	>= 2.1.0, < 2.1.9	2.1.9

Details and references

Severity from: no source yet

More Apache Software Foundation advisories

All Apache Software Foundation

Date	Advisory	Severity	Fixed in
Oct 2	Apache Thrift: resource exhaustion High8.2Oct 2 CVE-2026-946550.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: resource exhaustion High8.2Oct 2 CVE-2026-946560.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: resource exhaustion High8.2Oct 2 CVE-2026-946570.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: infinite loop High8.2Oct 2 CVE-2026-946540.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: infinite loop High8.2Oct 2 CVE-2026-854760.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: integer overflow Critical9.2Oct 2 CVE-2026-836320.25.0	Critical9.2	0.25.0