Apache LDAP API CVE-2026-102731

Exploitation requires the victim to establish an LDAP connection that an attacker can respond to or intercept - i.e. the client connects to an attacker-controlled or compromised LDAP server, or the attacker holds a man-in-the-middle position on the LDAP channel; the malicious BER response can be delivered by an unauthenticated pre-bind peer. The key limiting factor is that the attacker must be able to return server responses to the victim client, so purely outbound connections to trusted directory servers are not exposed. Embedding servers are notably exposed only when they did NOT set the MAX_PDU_SIZE_ATTR limit; setting that attribute caps the allocation and mitigates the issue. Applies to Apache Directory LDAP API versions 1.2.0 up to (not including) 1.2.9.

This is a genuine but moderate-priority availability issue. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) is internally consistent with the description: a malicious LDAP peer or MITM can trigger a large memory allocation from a small BER-encoded response over the network, with no authentication or user interaction, affecting only availability (OutOfMemoryError / heap exhaustion), no confidentiality or integrity impact. The SSVC framework aligns and tempers this: Exploitation=none (no observed exploitation), Automatable=yes (the same malicious bytes work repeatedly against any vulnerable client/embedding server), Technical Impact=partial (DoS, not full compromise). EPSS is low at 0.19% (8th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of real-world exploitation. The signals are therefore consistent rather than conflicting: a real, easily-automatable DoS primitive but currently with low exploitation likelihood. Priority should be driven by exposure - clients or embedding servers that connect to untrusted LDAP endpoints or are reachable by pre-bind unauthenticated peers warrant prompt patching; purely internal deployments talking only to trusted directory servers face lower practical risk. Note the high CVSS (7.5) reflects easy, unauthenticated, network-triggerable DoS, not severity of impact, which is limited to availability.

An attacker who controls an LDAP server, or performs a man-in-the-middle on a client's LDAP connection, returns a small crafted BER-encoded response whose length field declares a very large value. The client's Apache Directory LDAP API decoder allocates the oversized buffer before any payload arrives, and a handful of such connections exhaust the JVM heap, producing an OutOfMemoryError that crashes or hangs the client (or an embedding server that did not set MAX_PDU_SIZE_ATTR). No public exploit was identified at time of analysis, but the technique is trivially reproducible from the description.