EUVD-2026-91359
GHSA-q4px-5x5j-5p92
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessStore password with bcrypt cost 30
-
DeliverySend LDAP bind/credential-check request
-
ExploitTrigger unbounded bcrypt verification
-
ExecutionCPU pinned for hours per check
-
ImpactServer denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Asymmetric resource consumption control
|
| Exploitation Conditions | Exploitation requires the LDAP server (via the Apache Directory LDAP API) to support and store a password hashed with the bcrypt algorithm using an attacker-chosen high work/cost factor (e.g. 30); the expensive, unbounded credential verification is then triggered by bind/credential-check operations. Limiting factors: bcrypt must be in use and a high-cost hash must have been stored, which in practice requires write access to set that credential, so the effective precondition is an operator or authenticated action rather than a purely default-configuration remote trigger; versions before 2.1.9 only. Impact is confined to CPU exhaustion/DoS with no data exposure. |
| Impact | Signals are mostly consistent and point to a moderate, not urgent, priority. The published CVSS is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), a pure availability impact with no confidentiality or integrity loss, matching CWE-405 (Asymmetric Resource Consumption). EPSS is low at 0.20% (9th percentile), the issue is NOT in CISA KEV, and no public exploit code is identified, so exploitation status is 'no public exploit identified at time of analysis' - these three signals agree that widespread exploitation is unlikely. The main tension is PR:N: the NVD vector implies fully unauthenticated attack, but the description's mechanism requires a password to be STORED with a high bcrypt cost factor (e.g. 30), which in practice requires write/management access to set the credential before the expensive verification can be triggered - so the real-world precondition likely involves some authenticated or operator action, making PR:N arguably optimistic. Net: a legitimate availability/DoS hardening fix worth patching on a normal cycle, but not an emergency given low EPSS, no KEV, no POC, and a non-trivial setup precondition. |
| Exploit ScenarioDerived | An actor with the ability to set a user password configures it to use bcrypt with an abnormally high work factor (such as cost 30), then issues LDAP bind/credential-check requests against a server using the vulnerable Apache Directory LDAP API. Each verification pins a CPU core for hours, and repeated binds exhaust server CPU and deny service to legitimate clients. No public exploit code is identified at the time of analysis, and no confidentiality or integrity impact occurs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
CPU exhaustion in Apache Directory LDAP API versions 2.1.0 through 2.1.8 allows an attacker who can cause a password to be stored as a bcrypt hash with an attacker-chosen high cost factor (for example 30) to force the LDAP server to burn hours of CPU time on a single credential verification, producing a denial of service (CWE-405, Asymmetric Resource Consumption). Because the expensive hash must first be stored, the effective precondition is write access to the credential or an operator action rather than a purely default-configuration remote trigger, which keeps the assessed vector authenticated (PR:L) despite the vendor's PR:N framing; availability is the only impacted property, with no data exposure. No public exploit code has been identified at time of analysis and EPSS is low at 0.20 percent (9th percentile), so the issue is a moderate, not urgent, priority; the fix is the vendor-released 2.1.9.
RemediationAI
Vendor-released patch: 2.1.9 - upgrade Apache Directory LDAP API from any 2.1.x version below 2.1.9 to 2.1.9, which bounds the bcrypt cost the library will process; this is the primary and recommended fix and is documented in the Apache thread at https://lists.apache.org/thread.html/39q63m54v9go6xj7pqj7q18c3szn9go4 and the oss-security post at https://seclists.org/oss-sec/2026/q4/36 (mirrored at http://www.openwall.com/lists/oss-security/2026/10/02/7). If upgrading is delayed, apply these compensating controls: first, cap the permitted bcrypt cost to a sane value (for example 10-14) by rejecting or rewriting stored hashes that exceed the cap at bind time, accepting the side effect that if such rewriting is impossible you must reject the affected accounts' binds, causing lockout for users holding over-cost hashes; second, restrict write access to password attributes so only trusted provisioning paths may set userPassword, which directly removes the precondition of being able to plant a high-cost hash but requires tightening ACLs and may break self-service password change flows unless those flows are routed through a validating service; third, apply rate limiting or concurrency caps on bind and credential-check operations per account and per source address, which blunts repeat-trigger CPU burn at the cost of added bind latency and possible throttling of legitimate authentication bursts; and finally, monitor server CPU and authentication latency for abnormally long bind operations as a detection control. Note that no public exploit code has been identified and EPSS is 0.20 percent, so these workarounds are reasonable interim measures rather than emergency mitigations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Apache Directory LDAP API is the Java library used to build LDAP clients and embed LDAP server functionality, and it supports pluggable password storage schemes including bcrypt. Bcrypt is a deliberately slow key-derivation function whose work factor is exponential: each increment of the cost parameter doubles the number of key-expansion rounds, so a cost of 30 implies on the order of 2^30 iterations and can occupy a CPU core for hours. CVE-2026-103880 is a CWE-405 (Asymmetric Resource Consumption / Amplification) flaw: a cheap request such as a bind or credential check is amplified into a disproportionately expensive server-side computation because the library did not bound the bcrypt cost it is willing to verify. The attack therefore hinges on two conditions being true simultaneously - bcrypt must be the configured storage scheme, and a hash with an excessive cost must have been written into the directory, which normally requires write privileges over the userPassword attribute (consistent with the independently assessed PR:L vector and the multi-source version range 2.1.0 up to but not including 2.1.9). Note that the supplied tags label this issue 'Information Disclosure', which is inconsistent with the availability-only impact described by the CWE and the assessed vector; no confidentiality impact should be inferred from that tag.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Triggering the unbounded bcrypt check requires first storing a high-cost password, implying at least low-privilege write access (PR:L); impact is availability-only (A:H, C:N, I:N).
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.
Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced to avoid a server DOS.
This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.
Users are recommended to upgrade to version 2.1.9, which fixes the issue.
Executive ViewAI
Organizations using Apache Directory LDAP API versions 2.1.0 through 2.1.8 are exposed to a denial-of-service condition where an attacker with the ability to store a specially crafted bcrypt hash can cause excessive CPU consumption during authentication, potentially rendering the LDAP service unavailable. While the vulnerability is rated HIGH severity, exploitation requires authenticated write access or an operator action, and no public exploit identified at time of analysis, making the immediate risk moderate. Leadership should prioritize patching to version 2.1.9 to maintain service availability.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB