CVE-2026-103885

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-02

Last updated on: 2026-10-08

Assigner: Apache Software Foundation

Description

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-02

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-10-02

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103885

EUVD

EUVD-2026-91362

Affected Vendors & Products

Vendor	Product	Version / Range
Apache	Software	Foundation Apache Directory LDAP API 2.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This is an Asymmetric Resource Consumption vulnerability in the Apache Directory LDAP API. It allows a malicious actor to craft a poorly formatted telephone number that causes an LDAP server using this API to consume 100% of a CPU core indefinitely.

Detection Guidance

This vulnerability may cause high CPU usage on a system running Apache Directory LDAP API versions before 2.1.9. Monitor CPU usage with system tools like 'top', 'htop', or 'ps aux' to detect abnormal consumption. Check logs for LDAP API processes to identify unusual activity.

Impact Analysis

This vulnerability can lead to denial of service by making the LDAP server unresponsive due to high CPU usage. It may disrupt services relying on LDAP for authentication or directory services.

Compliance Impact

This vulnerability causes indefinite 100% CPU consumption on LDAP servers, which could lead to service disruptions or degraded performance. Such resource exhaustion may impact availability requirements under GDPR (Article 32) and HIPAA (Security Rule §164.308(a)(7)), potentially violating availability obligations.

Mitigation Strategies

Upgrade Apache Directory LDAP API to version 2.1.9 or later to resolve the issue. If upgrading is not immediately possible, restrict access to the LDAP server or disable vulnerable Telephone Number processing until the update is applied.

Hi! I’m here to help you understand CVE-2026-103885. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70