Bug 2544985 (CVE-2026-102731)

Summary: CVE-2026-102731 org.apache.directory.api/api-asn1-ber: Apache Directory LDAP API: Denial of Service via excessive memory allocation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: gmalinko, janstey, pdelbell, rstepani
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Apache Directory LDAP API. A malicious LDAP peer or a network attacker able to intercept the connection can send a small BER-encoded response with an excessive size value, causing the client to allocate a large amount of memory before receiving the data. This can trigger an OutOfMemoryError and denial of service. An embedding LDAP server can also be affected by unauthenticated pre-bind input if `MAX_PDU_SIZE_ATTR` is not set. Apache Directory LDAP API versions 1.2.0 through versions before 1.2.9 are affected; version 1.2.9 fixes the issue.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-02 09:31:18 UTC 
Memory allocation with excessive size value vulnerability in Apache Directory LDAP API.



A malicious peer (or a MITM) can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service.



The client JVM OOMs (OutOfMemoryError bypasses the DecoderException handlers) or pins the large allocation per connection while the attacker stalls.



A handful of connections exhausts any heap. The same bytes from an unauthenticated pre-bind client hit any embedding server that did not set MAX_PDU_SIZE_ATTR.



This issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9.



Users are recommended to upgrade to version 1.2.9, which fixes the issue.