Apache LDAP API CVE-2026-103552

Exploitation requires a server-side component that uses the Apache Directory LDAP API (versions 1.2.0 through 1.2.8) to decode client-supplied LDAP search filters, reachable over the network. The critical enabling condition is that the malicious filter is processed 'before binding,' so NO authentication is required. Limiting factors: the target must actually run a vulnerable 1.2.0-1.2.8 version in a decoder/server role that parses untrusted filters, and deployments on 1.2.9 or later, or those not exposing filter decoding to untrusted clients, are not affected. The realistic impact is service crash (availability), which bounds the damage versus a code-execution flaw.

No CVSS vector, EPSS score, KEV listing, or public POC was provided in the input, so quantitative exploitation signals are entirely absent and the assessment rests on the description and CWE-121 alone. The description is favorable to an attacker on access terms: the malicious deeply nested search filter is sent 'before binding,' meaning no authentication is required, and LDAP is a network-facing protocol - so the reachability profile is network, low-complexity, unauthenticated. However, the technical impact is most plausibly a denial of service: a 'deeply nested search filter that overflows the stack in the server's decoder' describes recursion-driven stack exhaustion, which typically crashes the parsing process rather than yielding code execution, despite the CWE-121 (stack-based buffer overflow) label. Net real-world risk is moderate: easy to trigger remotely without credentials, but the outcome is availability loss rather than confidentiality/integrity compromise, and the affected component is a specific Java library rather than a ubiquitous platform. This is a patch-worthy availability issue for exposed deployments, not a critical RCE - though note the CWE-121 classification leaves a residual, unconfirmed possibility of memory corruption beyond a simple crash that should be verified with the Apache advisory. Exploitation status: no public exploit identified at time of analysis.

An unauthenticated attacker with network reachability to a service that uses the Apache Directory LDAP API to decode incoming LDAP search requests sends a single search operation containing a filter nested to extreme depth, before any bind/authentication occurs. The vulnerable decoder recurses through the nested structure until it exhausts the thread/process stack and crashes, causing a denial of service. No public exploit code was identified, but the attack requires only a crafted protocol message and no credentials.