CVE-2026-102731: Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode
Memory allocation with excessive size value vulnerability in Apache Directory LDAP API.
A malicious peer (or a MITM) can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service.
The client JVM OOMs (OutOfMemoryError bypasses the DecoderException handlers) or pins the large allocation per connection while the attacker stalls.
A handful of connections exhausts any heap. The same bytes from an unauthenticated pre-bind client hit any embedding server that did not set MAXPDUSIZEATTR.
This issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9.
Users are recommended to upgrade to version 1.2.9, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Directory LDAP APIto a version that resolves this vulnerability.Fixed in 1.2.9
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
LDAP API clients are exposed when they process responses from a malicious LDAP peer or a man-in-the-middle. Servers embedding the API are also exposed to unauthenticated pre-bind clients if MAX_PDU_SIZE_ATTR has not been set.
What does an attacker need to do to cause denial of service?
An attacker needs to send a small BER-encoded message containing an excessive size value. This can trigger a very large allocation before the corresponding data is received; stalling after allocation can pin memory per connection, and only a handful of connections may exhaust the heap.
Are exception handlers sufficient to prevent the client-side failure?
No. The affected client JVM can throw an OutOfMemoryError, which bypasses the DecoderException handlers described in the issue.
What mitigation is available if an immediate upgrade is not possible?
For embedding servers, set MAX_PDU_SIZE_ATTR to prevent unauthenticated pre-bind input from reaching this condition. The recommended remediation is upgrading to Apache Directory LDAP API version 1.2.9.