CVE-2026-103880: apache software foundation apache directory ldap api

Vulnerability summary

CVE-2026-103880 is a high (CVSS 7.5) vulnerability in apache software foundation apache directory ldap api. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.6% of scored vulnerabilities.

Timeline

1. 02-10-2026
   PublishedVulnerability first disclosed.
2. 05-10-2026
   Last modifiedVulnerability information updated.

Description

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to  run for hours checking the credentials. A bounded cost should be enforced to avoid a server DOS. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9, which fixes the issue.

• CWE-405Asymmetric Resource Consumption (Amplification)The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."