CVE-2026-103880

The Apache Directory LDAP API is vulnerable to an Asymmetric Resource Consumption (CWE-405) vulnerability. When storing a password using the bcrypt algorithm with a high cost factor (e.g., 30), the server CPU can be forced to run for hours while checking credentials, leading to a Denial of Servic...

CVE-2026-103880 Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced...

CVE-2026-103880

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced...

CVE-2026-103878

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API:...

CVE-2026-103878 Apache Directory LDAP API: Injection of plaintext responses during StartTLS

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API:...

EUVD-2026-91378

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API:...

CVE-2026-103878

The Apache Directory LDAP API versions 2.1.0 through 2.1.8 are vulnerable to a cleartext transmission of sensitive information. The root cause involves a StartTLS extended operation initiated after a Search request has been sent, which can result in data being received in plain text before the TL...

CVE-2026-103878 Apache Directory LDAP API: Injection of plaintext responses during StartTLS

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API:...

CVE-2026-103878

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API:...

CVE-2026-103552

Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. This issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9. Users are recommended to upgrade to version 1.2.9,...

CVE-2026-103552 Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder

Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. This issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9. Users are recommended to upgrade to version 1.2.9,...

EUVD-2026-91382

Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. This issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9. Users are recommended to upgrade to version 1.2.9,...

CVE-2026-103552

A Stack Overflow vulnerability exists in the Apache Directory LDAP API (versions 1.2.0 to before 1.2.9). An unauthenticated remote attacker can trigger this by submitting a deeply nested search filter before binding with the server. The flaw occurs in the server's decoder, which can lead to an ap...

CVE-2026-103552 Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder

Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. This issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9. Users are recommended to upgrade to version 1.2.9,...

CVE-2026-103552

Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. This issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9. Users are recommended to upgrade to version 1.2.9,...

CVE-2026-94639

improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94639 Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)

improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91339

improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94639

The Apache Thrift Java bindings are vulnerable to an uncaught exception and improper handling of exceptional conditions , specifically involving the allocation of resources without limits or throttling . This issue is identified as a residual of CVE-2026-61373, involving a thread-death black hole...

CVE-2026-94639 Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)

improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...