# CVE-2026-103880: Apache Directory LDAP API asymmetric resource consumption in bcrypt

Source: https://junglewise.ai/threats/cve-2026-103880-asymmetric-resource-consumption-vulnerability-in-apache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-103880 · Severity: info · Published 2026-10-02

Apache Directory LDAP API is a Java library used to build LDAP server and client applications for enterprise directory services. A vulnerability allows attackers to cause severe server slowdown or outage by storing passwords with an excessively high bcrypt computational cost, forcing the server to consume CPU resources for hours during credential validation. This denial-of-service condition could prevent legitimate users from accessing directory services.

Technologies: [Apache Directory Ldap Api](https://junglewise.ai/threats/technologies/directory-ldap-api). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-103880 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103880 being exploited in the wild.

**How severe is CVE-2026-103880?** Informational severity, published 2 October 2026.

**Which products and versions are affected?** Apache Directory Ldap Api 2.1.0 before 2.1.9.

**Is there a fix for CVE-2026-103880?** Yes: fixed in 2.1.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103880 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-103880?** Check whether you run Apache Directory Ldap Api at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.1.9

## Technical details

The vulnerability is an asymmetric resource consumption flaw in bcrypt password handling within Apache Directory LDAP API versions 2.1.0 through 2.1.8. An attacker can supply a bcrypt cost parameter (e.g., 30) that forces the server to perform intensive CPU operations during password verification, consuming server resources and degrading performance. No authentication or special access is required; the attack can be triggered during password storage or verification operations in LDAP directory services.

## Affected products

- Apache Directory LDAP API 2.1.0 before 2.1.9

## Timeline

- 2026-10-02: disclosed
- 2026-10-02: patched

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/39q63m54v9go6xj7pqj7q18c3szn9go4](https://lists.apache.org/thread.html/39q63m54v9go6xj7pqj7q18c3szn9go4)

## Related threats

- [Apache Directory LDAP API DoS via malformed telephone numbers](https://junglewise.ai/threats/cve-2026-103885-asymmetric-resource-consumption-vulnerability-in-apache)
- [Apache Directory LDAP API cleartext transmission of sensitive information in StartTLS](https://junglewise.ai/threats/cve-2026-103878-cleartext-transmission-of-sensitive-information-vulnerability-in)
- [Apache Directory LDAP API Java deserialization in loadSchema](https://junglewise.ai/threats/cve-2026-103877-deserialization-of-untrusted-data-vulnerability-in-apache)
- [Apache Directory LDAP API stack overflow in search filter decoder](https://junglewise.ai/threats/cve-2026-103552-stack-overflow-vulnerability-in-apache-directory-ldap-api-before)
- [Apache Directory LDAP API memory allocation denial of service](https://junglewise.ai/threats/cve-2026-102731-memory-allocation-with-excessive-size-value-vulnerability-in)