CVE-2026-103885: Apache Directory LDAP API: Denial of service via crafted telephone number values
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.
A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers.
This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.
Users are recommended to upgrade to version 2.1.9, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Directory LDAP APIto a version that resolves this vulnerability.Fixed in 2.1.9
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
LDAP servers that use Apache Directory LDAP API, including Apache DS, are affected when running versions from 2.1.0 before 2.1.9. The issue is triggered while processing crafted Telephone Number values.
What does an attacker need to do to cause impact?
An attacker needs to submit a badly crafted Telephone Number for the server to process. Successful processing can cause the server to consume 100% of one CPU core indefinitely.
What is the recommended remediation?
Upgrade Apache Directory LDAP API to version 2.1.9, which fixes the issue.