CVE-2026-103885
Received Received - Intake

Asymmetric Resource Consumption in Apache Directory LDAP API

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: Apache Software Foundation

Description
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-103885
EUVD
EUVD-2026-91362

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache directory_ldap_api From 2.1.0 (inc) to 2.1.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Asymmetric Resource Consumption vulnerability in the Apache Directory LDAP API. It allows a malicious actor to craft a poorly formatted telephone number that causes an LDAP server using this API to consume 100% of a CPU core indefinitely.

Detection Guidance

This vulnerability may cause high CPU usage on a system running Apache Directory LDAP API versions before 2.1.9. Monitor CPU usage with system tools like 'top', 'htop', or 'ps aux' to detect abnormal consumption. Check logs for LDAP API processes to identify unusual activity.

Impact Analysis

This vulnerability can lead to denial of service by making the LDAP server unresponsive due to high CPU usage. It may disrupt services relying on LDAP for authentication or directory services.

Mitigation Strategies

Upgrade Apache Directory LDAP API to version 2.1.9 or later to resolve the issue. If upgrading is not immediately possible, restrict access to the LDAP server or disable vulnerable Telephone Number processing until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103885. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart