Apache Directory LDAP API CVE-2026-103885

Exploitation requires that the target run an LDAP server using the Apache Directory LDAP API (e.g., Apache DS) at a version from 2.1.0 up to but not including 2.1.9, with the LDAP service reachable by the attacker and accepting attribute values containing Telephone Number syntax for parsing. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special non-default configuration are needed - any network-reachable vulnerable instance that parses the crafted Telephone Number is affected. The principal limiting factors are network exposure of the LDAP endpoint and whether the deployment is within the vulnerable version window; impact is limited to availability (one CPU core pinned), with no path to data access or code execution.

This is a genuine but moderate-priority availability flaw, not a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) shows a cleanly remote, unauthenticated, low-complexity denial-of-service with no confidentiality or integrity impact - the score is driven entirely by A:H. All exploitation signals point to low urgency: EPSS is 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code was identified, so exploitation status is 'no public exploit identified at time of analysis.' CISA SSVC reinforces this with Exploitation: none, though it flags Automatable: yes and Technical Impact: partial, meaning a working exploit could be scripted broadly but the damage is confined to resource exhaustion rather than code execution or data loss. The signals are internally consistent - high-ish CVSS from availability alone, low EPSS, no active exploitation - indicating a real DoS worth patching on a normal cadence rather than a drop-everything incident. Note one metadata conflict: the input Tags include 'Information Disclosure,' which contradicts the description and the CVSS (C:N) - this is purely a CPU-exhaustion/DoS issue, so that tag appears mislabeled.

A remote, unauthenticated attacker connects to an LDAP server built on the Apache Directory LDAP API (such as Apache DS) and submits a specially crafted Telephone Number value that the parser cannot process efficiently. Parsing enters effectively unbounded work, pinning a CPU core at 100% indefinitely and degrading or denying service to legitimate clients. No public exploit code is known, but the low attack complexity (AC:L) and SSVC Automatable:yes mean a reliable DoS trigger would be straightforward to develop and repeat.