CVE-2026-103880 in Directory LDAP API
Summary
by MITRE • 10/02/2026
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.
Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced to avoid a server DOS.
This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.
Users are recommended to upgrade to version 2.1.9, which fixes the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in Apache Directory LDAP API represents a classic asymmetric resource consumption flaw, often categorized under CWE-400: Uncontrolled Resource Consumption. This specific instance arises from the improper handling of password hashing parameters within the authentication workflow. When an administrator or application stores a user's password using the bcrypt algorithm with an excessively high computational cost factor, such as 30, it creates a significant disparity in resource utilization between legitimate users and potential attackers. The core technical flaw lies in the server's failure to enforce upper bounds on these cryptographic parameters during both storage and verification phases. While setting a high work factor is generally recommended for password hashing to increase resistance against brute-force attacks, an unbounded value like 30 results in computational requirements that are disproportionate to standard authentication expectations.
From an operational perspective, this misconfiguration leads directly to a Denial of Service condition. When the LDAP server attempts to verify credentials for any user whose stored hash utilizes such a high cost factor, the CPU must perform an immense number of iterations associated with the bcrypt algorithm. This process can consume processor cycles for hours rather than milliseconds or seconds, effectively freezing the authentication service. Since LDAP is often used as a central directory for access control across multiple enterprise systems, this single point of failure can cascade into widespread unavailability for any application relying on that directory for user validation. The impact is particularly severe because it does not require malicious intent from an external attacker; simply having a misconfigured account with such high-cost credentials in the database is sufficient to trigger the resource exhaustion during routine login attempts by legitimate users or automated health checks.
This vulnerability aligns with MITRE ATT&CK technique T1496: Resource Hijacking, where attackers or poorly configured systems consume excessive computational resources to degrade service availability. It also relates to CWE-755: Improper Handling of Unexpected Parameter Value, as the system fails to validate that the provided cost factor falls within an acceptable operational range. The lack of input validation for cryptographic parameters allows values that are technically valid according to the bcrypt specification but operationally catastrophic in a high-throughput authentication environment. This highlights a critical gap in security configuration management where theoretical best practices for password hashing are applied without considering their practical impact on system performance and availability.
To mitigate this risk, organizations must immediately audit their LDAP directories for any accounts or entries that utilize excessively high bcrypt cost factors. The recommended approach is to enforce strict upper bounds on the computational cost parameter during both hash generation and verification processes. Upgrading Apache Directory LDAP API to version 2.1.9 is essential as it addresses these validation gaps by implementing appropriate limits on resource consumption. Additionally, administrators should implement monitoring solutions that detect unusual spikes in CPU usage associated with authentication endpoints. By combining software updates with proactive configuration management and performance monitoring, organizations can prevent asymmetric resource attacks and ensure the continuous availability of critical directory services.