CVE-2026-102731

Overview

Apache Directory LDAP API can allocate excessive memory when receiving a small BER-encoded response, leading to OutOfMemoryError and denial of service. The flaw allows attackers to exhaust heap space with a handful of connections. It affects all Java applications using the vulnerable API before version 1.2.9.

Description

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer (or a MITM) can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs (OutOfMemoryError bypasses the DecoderException handlers) or pins the large allocation per connection while the attacker stalls. A handful of connections exhausts any heap. The same bytes from an unauthenticated pre-bind client hit any embedding server that did not set MAX_PDU_SIZE_ATTR. This issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9. Users are recommended to upgrade to version 1.2.9, which fixes the issue.

Impact

Denial of Service through OutOfMemoryError. Availability of services that rely on LDAP is compromised, potentially disrupting authentication, directory lookups, and any dependent applications. The impact is limited to the affected JVM process but can cascade to the entire service.

Remediation

Upgrade to Apache Directory LDAP API 1.2.9 or later. If upgrade is delayed, set the MAX_PDU_SIZE_ATTR configuration to limit allocation size. Monitor JVM heap usage and apply JVM memory limits (e.g., -Xmx) to mitigate resource exhaustion.

Risk context

Severity is high with a CVSS v3 score of 7.5, but the EPSS of 0.00193 indicates low likelihood of exploitation. Nonetheless, the potential for service disruption warrants prompt patching.

Affected products

• Apache Directory LDAP API