CVE-2026-103885 — Apache Directory LDAP API: Denial of service via crafted telephone number values

Description (CNA)

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Directory LDAP API	affected 2.1.0 before 2.1.9

CWE

No CWE identifiers supplied.

References

https://lists.apache.org/thread.html/wjt9p1l123v6b3zd5dg41f8lfrgy5vg9

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/10/02/8

CISA-ADP

No English description supplied.

No references supplied.