CVE-2026-103885 PUBLISHED

Apache Directory LDAP API: Denial of service via crafted telephone number values

Assigner: apache
Reserved: 01.10.2026 Published: 02.10.2026 Updated: 02.10.2026

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.

A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers.

This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.

Users are recommended to upgrade to version 2.1.9, which fixes the issue.

Product Status

Vendor Apache Software Foundation
Product Apache Directory LDAP API
Versions Default: unaffected
  • affected from 2.1.0 to 2.1.9 (excl.)

Credits

  • Claude Security tool
  • The Apache Software Foundation finder

References