# CVE-2026-103885: Apache Directory LDAP API DoS via malformed telephone numbers

Source: https://junglewise.ai/threats/cve-2026-103885-asymmetric-resource-consumption-vulnerability-in-apache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-103885 · Severity: info · Published 2026-10-02

Apache Directory LDAP API, a Java library used by LDAP servers like Apache DS, can be made to consume 100% of a CPU core indefinitely when processing specially crafted telephone number fields in LDAP requests. An attacker can send malformed LDAP messages to cause a denial of service that hangs the server without crashing it, disrupting directory services for legitimate users.

Technologies: [Apache Directory Ldap Api](https://junglewise.ai/threats/technologies/directory-ldap-api). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-103885 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103885 being exploited in the wild.

**How severe is CVE-2026-103885?** Informational severity, published 2 October 2026.

**Which products and versions are affected?** Apache Directory Ldap Api 2.1.0 to 2.1.8.

**Is there a fix for CVE-2026-103885?** Yes: fixed in 2.1.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103885 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-103885?** Check whether you run Apache Directory Ldap Api at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.1.9

## Technical details

This is an asymmetric resource consumption vulnerability in the LDAP API's telephone number parsing logic. A remote attacker can send an LDAP message containing a malformed telephone number attribute that triggers infinite or extremely long-running regex or parsing logic, consuming CPU indefinitely. No authentication is required; the attack succeeds on any exposed LDAP server using the vulnerable library versions.

## Affected products

- Apache Directory LDAP API 2.1.0 to 2.1.8

## Timeline

- 2026-10-02: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/wjt9p1l123v6b3zd5dg41f8lfrgy5vg9](https://lists.apache.org/thread.html/wjt9p1l123v6b3zd5dg41f8lfrgy5vg9)

## Related threats

- [Apache Directory LDAP API asymmetric resource consumption in bcrypt](https://junglewise.ai/threats/cve-2026-103880-asymmetric-resource-consumption-vulnerability-in-apache)
- [Apache Directory LDAP API cleartext transmission of sensitive information in StartTLS](https://junglewise.ai/threats/cve-2026-103878-cleartext-transmission-of-sensitive-information-vulnerability-in)
- [Apache Directory LDAP API Java deserialization in loadSchema](https://junglewise.ai/threats/cve-2026-103877-deserialization-of-untrusted-data-vulnerability-in-apache)
- [Apache Directory LDAP API stack overflow in search filter decoder](https://junglewise.ai/threats/cve-2026-103552-stack-overflow-vulnerability-in-apache-directory-ldap-api-before)
- [Apache Directory LDAP API memory allocation denial of service](https://junglewise.ai/threats/cve-2026-102731-memory-allocation-with-excessive-size-value-vulnerability-in)