Bug 2545002 (CVE-2026-103885)
| Summary: | CVE-2026-103885 org.apache.directory.api/api-ldap-model: Apache Directory LDAP API: Denial of Service via crafted telephone numbers | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | gmalinko, janstey, pdelbell, rstepani |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Apache Directory LDAP API. This vulnerability allows an attacker to cause a Denial of Service (DoS) by submitting specially crafted telephone numbers to an LDAP (Lightweight Directory Access Protocol) server using the library. Processing these malformed inputs causes indefinite CPU core consumption, which can severely degrade performance or render directory services unresponsive. Apache Directory LDAP API versions 2.1.0 through versions before 2.1.9 are affected. Upgrade to version 2.1.9 to address this issue.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-02 10:22:00 UTC
|