# CVE-2026-103552: Apache Directory LDAP API stack overflow in search filter decoder

Source: https://junglewise.ai/threats/cve-2026-103552-stack-overflow-vulnerability-in-apache-directory-ldap-api-before  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-103552 · Severity: high · CVSS 7.3 · Published 2026-10-02

Apache Directory LDAP API is a Java library used to interact with LDAP directory services. An unauthenticated attacker can send a specially crafted search filter with excessive nesting to cause a stack overflow in the server's decoder, potentially leading to denial of service or remote code execution.

Technologies: [Apache Directory Ldap Api](https://junglewise.ai/threats/technologies/directory-ldap-api). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-103552 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103552 being exploited in the wild.

**How severe is CVE-2026-103552?** High severity, with a CVSS score of 7.3, published 2 October 2026.

**Which products and versions are affected?** Apache Directory Ldap Api 1.2.0 to 1.2.8.

**Is there a fix for CVE-2026-103552?** Yes: fixed in 1.2.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103552 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-103552?** Check whether you run Apache Directory Ldap Api at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.2.9

## Technical details

A stack overflow vulnerability exists in the search filter decoding logic of Apache Directory LDAP API versions before 1.2.9. An unauthenticated client can exploit this by sending a deeply nested search filter before completing the bind operation, causing the decoder to exhaust the stack and crash the service or potentially execute arbitrary code.

## Affected products

- Apache Directory LDAP API 1.2.0 to 1.2.8

## Timeline

- 2026-10-02: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/fn3bwknn57266hx66w9vv6b4k8rfwcx7](https://lists.apache.org/thread.html/fn3bwknn57266hx66w9vv6b4k8rfwcx7)

## Related threats

- [Apache Directory LDAP API DoS via malformed telephone numbers](https://junglewise.ai/threats/cve-2026-103885-asymmetric-resource-consumption-vulnerability-in-apache)
- [Apache Directory LDAP API asymmetric resource consumption in bcrypt](https://junglewise.ai/threats/cve-2026-103880-asymmetric-resource-consumption-vulnerability-in-apache)
- [Apache Directory LDAP API cleartext transmission of sensitive information in StartTLS](https://junglewise.ai/threats/cve-2026-103878-cleartext-transmission-of-sensitive-information-vulnerability-in)
- [Apache Directory LDAP API Java deserialization in loadSchema](https://junglewise.ai/threats/cve-2026-103877-deserialization-of-untrusted-data-vulnerability-in-apache)
- [Apache Directory LDAP API memory allocation denial of service](https://junglewise.ai/threats/cve-2026-102731-memory-allocation-with-excessive-size-value-vulnerability-in)