CVE-2026-103880

7.5 Élevée

Publiée le 02/10/2026 à 12:17 · Modifiée le 05/10/2026 à 21:17 · Analyse NVD reportée · Source : security@apache.org

Description

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced to avoid a server DOS. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9, which fixes the issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache Directory LDAP API

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-405

Références

https://lists.apache.org/thread.html/39q63m54v9go6xj7pqj7q18c3szn9go4
http://www.openwall.com/lists/oss-security/2026/10/02/7

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories