CVE-2026-103885

Summary

This vulnerability allows attackers to cause indefinite CPU consumption on LDAP servers using the Apache Directory LDAP API by sending malformed telephone numbers, potentially leading to denial of service. The flaw affects versions before 2.1.9 and can be exploited remotely without authentication.

Exploitability

Exploitation is relatively straightforward as it requires only sending specially crafted telephone number data to an LDAP server, with no authentication needed and minimal preconditions.

Blast radius

The impact could affect multiple LDAP services across an organization, potentially causing widespread denial of service for directory-based authentication and access control systems that rely on Apache DS or similar LDAP implementations.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache Directory LDAP API version 2.1.9 immediately to address this asymmetric resource consumption vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.