{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103885", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-01T13:23:38.750Z", "datePublished": "2026-10-02T10:09:51.901Z", "dateUpdated": "2026-10-02T21:07:24.537Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-02T10:09:51.901Z"}, "title": "Apache Directory LDAP API: Denial of service via crafted telephone number values", "source": {"defect": ["CWE-405 Asymmetric Resource Consumption (Amplification)"], "discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Directory LDAP API", "packageURL": "pkg:maven/org.apache.directory.api/api-ldap-model", "versions": [{"status": "affected", "version": "2.1.0", "lessThan": "2.1.9", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.directory.api:api-ldap-model"}], "descriptions": [{"value": "Asymmetric Resource Consumption\u00a0vulnerability in Apache Directory LDAP API.\n\n\n\nA LDAP server using the LDAP API (like Apache DS)\u00a0may consume 100% of a CPU core indefinitely\u00a0when processing some badly crafted Telephone Numbers.\n\n\n\nThis issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.\n\n\n\nUsers are recommended to upgrade to version 2.1.9, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><span><span>Asymmetric Resource Consumption&nbsp;</span></span>vulnerability in Apache Directory LDAP API.</p><p>A LDAP server using the LDAP API (like Apache DS)&nbsp;may consume 100% of a CPU core indefinitely&nbsp;when processing some badly crafted Telephone Numbers.</p><p>This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.</p><p>Users are recommended to upgrade to version 2.1.9, which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/wjt9p1l123v6b3zd5dg41f8lfrgy5vg9", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Claude Security", "type": "tool"}, {"lang": "en", "value": "The Apache Software Foundation", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/02/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-02T21:07:24.537Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.directory.api:api-ldap-model", "packageURL": "pkg:maven/org.apache.directory.api/api-ldap-model", "product": "Apache Directory LDAP API", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.1.9", "status": "affected", "version": "2.1.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Asymmetric Resource Consumption\u00a0vulnerability in Apache Directory LDAP API.\n\n\n\nA LDAP server using the LDAP API (like Apache DS)\u00a0may consume 100% of a CPU core indefinitely\u00a0when processing some badly crafted Telephone Numbers.\n\n\n\nThis issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.\n\n\n\nUsers are recommended to upgrade to version 2.1.9, which fixes the issue."}], "id": "CVE-2026-103885", "lastModified": "2026-10-02T22:16:53.870", "metrics": {}, "published": "2026-10-02T10:17:06.833", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/wjt9p1l123v6b3zd5dg41f8lfrgy5vg9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/02/8"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "org.apache.directory.api/api-ldap-model: Apache Directory LDAP API: Denial of Service via crafted telephone numbers", "id": "2545002", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545002"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["A flaw was found in Apache Directory LDAP API. This vulnerability allows an attacker to cause a Denial of Service (DoS) by submitting specially crafted telephone numbers to an LDAP (Lightweight Directory Access Protocol) server using the library. Processing these malformed inputs causes indefinite CPU core consumption, which can severely degrade performance or render directory services unresponsive."], "name": "CVE-2026-103885", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "api-ldap-model", "product_name": "Red Hat Fuse 7"}], "public_date": "2026-10-02T10:09:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-103885\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-103885\nhttps://lists.apache.org/thread.html/wjt9p1l123v6b3zd5dg41f8lfrgy5vg9"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.1.0,2.1.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache Directory LDAP API", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "directory_ldap_api", "vendor": "apache"}], "created": "2026-10-02T11:30:18.295468+00:00", "updated": "2026-10-03T04:30:19.765962+00:00", "vendors": ["apache", "apache$PRODUCT$directory_ldap_api"]}