CVE-2026-102731

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer (or a MITM) can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs (OutOfMemoryError bypasses the DecoderException handlers) or pins the large allocation per connection while the attacker stalls. A handful of connections exhausts any heap. The same bytes from an unauthenticated pre-bind client hit any embedding server that did not set MAX_PDU_SIZE_ATTR. This issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9. Users are recommended to upgrade to version 1.2.9, which fixes the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread.html/b8kg8881pc0v8lp59w0fcfrs69wjbqvd
http://www.openwall.com/lists/oss-security/2026/10/02/3

Configurations

No configuration.

History

05 Oct 2026, 19:17

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5

02 Oct 2026, 22:16

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2026/10/02/3 -

02 Oct 2026, 10:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-02 10:17

Updated : 2026-10-05 19:17

NVD link : CVE-2026-102731

Mitre link : CVE-2026-102731

CVE.ORG link : CVE-2026-102731

JSON object : View

Products Affected

No product.

CWE

CWE-789

Memory Allocation with Excessive Size Value

{"id": "CVE-2026-102731", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102731", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-05T18:10:13.127732Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Directory LDAP API", "versions": [{"status": "affected", "version": "1.2.0", "lessThan": "1.2.9", "versionType": "semver"}], "packageURL": "pkg:maven/org.apache.directory.api/api-asn1-ber", "packageName": "org.apache.directory.api:api-asn1-ber", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-10-02T10:17:04.530", "references": [{"url": "https://lists.apache.org/thread.html/b8kg8881pc0v8lp59w0fcfrs69wjbqvd", "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/02/3", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "Memory allocation with excessive size value vulnerability in Apache Directory LDAP API.\n\n\n\nA malicious peer (or a MITM) can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service.\n\n\n\nThe client JVM OOMs (OutOfMemoryError bypasses the DecoderException handlers) or pins the large allocation per connection while the attacker stalls.\n\n\n\nA handful of connections exhausts any heap. The same bytes from an unauthenticated pre-bind client hit any embedding server that did not set MAX_PDU_SIZE_ATTR.\n\n\n\nThis issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9.\n\n\n\nUsers are recommended to upgrade to version 1.2.9, which fixes the issue."}], "lastModified": "2026-10-05T19:17:12.740", "sourceIdentifier": "security@apache.org"}