{"id":"CVE-2026-103885","published":"2026-10-02T10:17:06.833","lastModified":"2026-10-08T13:17:12.437","description":"Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.\n\n\n\nA LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers.\n\n\n\nThis issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.\n\n\n\nUsers are recommended to upgrade to version 2.1.9, which fixes the issue.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/wjt9p1l123v6b3zd5dg41f8lfrgy5vg9","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/02/8","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to cause indefinite CPU consumption on LDAP servers using the Apache Directory LDAP API by sending malformed telephone numbers, potentially leading to denial of service. The flaw affects versions before 2.1.9 and can be exploited remotely without authentication.","exploitability":"Exploitation is relatively straightforward as it requires only sending specially crafted telephone number data to an LDAP server, with no authentication needed and minimal preconditions.","blast_radius":"The impact could affect multiple LDAP services across an organization, potentially causing widespread denial of service for directory-based authentication and access control systems that rely on Apache DS or similar LDAP implementations.","remediation":"Upgrade to Apache Directory LDAP API version 2.1.9 immediately to address this asymmetric resource consumption vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["denial-of-service","ldap","resource-consumption","directory-service"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:04:20.381Z"}}