Apache Software Foundation Apache Directory LDAP API vulnerabilities

6 CVEs affecting Apache Software Foundation Apache Directory LDAP API, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-103885, published 2026-10-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-103877, published 2026-10-02. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema…
CVE-2026-103885, published 2026-10-02. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly…
CVE-2026-103880, published 2026-10-02. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm…
CVE-2026-102731, published 2026-10-02. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer (or a MITM) can send a small BER-encoded response causing a large memory allocation before…
CVE-2026-103552, published 2026-10-02. High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days. Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. This issue affects…
CVE-2026-103878, published 2026-10-02. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in…