CVE-2026-103880

EUVD-2026-91359

02.10.2026, 10:17

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.

Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced to avoid a server DOS.

This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.

Users are recommended to upgrade to version 2.1.9, which fixes the issue.

Amplification

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
apache	CNA	UNKNOWN				---

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
apache	directory_ldap_api	2.1.0 ≤ 𝑥 < 2.1.9	CNA

Common Weakness Enumeration

CWE-405 - Asymmetric Resource Consumption (Amplification)
Software that does not appropriately monitor or control resource consumption can lead to adverse system performance.

References

https://lists.apache.org/thread.html/39q63m54v9go6xj7pqj7q18c3szn9go4