Bug 2545003 (CVE-2026-103880)

Summary: CVE-2026-103880 org.apache.directory.api/api-ldap-model: Apache Directory LDAP API: Denial of Service via unbounded bcrypt computation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: gmalinko, janstey, pdelbell, rstepani
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Apache Directory LDAP API. This vulnerability allows an attacker to cause a Denial of Service (DoS) by storing or verifying passwords hashed with an excessively high bcrypt work factor. Because the library fails to enforce an upper bound on computational cost during password verification, the server consumes excessive CPU resources for extended periods, rendering the service unresponsive to legitimate users.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-02 10:22:37 UTC 
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.



Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to  run for hours checking the credentials. A bounded cost should be enforced to avoid a server DOS.



This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.



Users are recommended to upgrade to version 2.1.9, which fixes the issue.