Three Failure Modes in One Library, One Release

Overview

CVE-2026-103552 is a stack-based buffer overflow, CWE-121, rated 7.3 under CVSS v3, in the Apache Directory LDAP API, corrected in version 1.2.9. It is useful to read alongside the other LDAP API fixes from the same Apache batch, because together they show three different ways untrusted input can exhaust a process.

Depth: CVE-2026-103552

Filter evaluation is recursive, and the affected releases did not bound how deep the recursion could run. A deeply nested search filter drives the call stack past its limit and overwrites adjacent memory. The fix is a hard ceiling on nesting depth, enforced before the recursion descends.

Allocation: CVE-2026-102731

An attacker can steer the client into an oversized memory allocation. Here the resource is heap rather than stack, and the failure mode is exhaustion rather than overflow. The lesson is the same: a request that controls a size must be checked against a sane maximum.

Cost per request: telephone numbers and bcrypt

Two further issues from the batch let a crafted telephone number or a bcrypt hash with very high cost pin a CPU core. This is algorithmic work amplification, where a small request buys a large amount of computation. The defense is a cap on cost and a limit on how much work one unauthenticated peer can request.

Impact and exploitation

Apache reported no confirmed exploitation and no public proof of concept for the batch. The confirmed risks are denial of service and integrity loss in directory-facing processes, with code execution unproven for the overflow record.

Affected scope

Apache Directory LDAP API 2.1.0 before 2.1.9 and 1.2.0 before 1.2.9; CVE-2026-103552 sits in the 1.2.x group and is fixed in 1.2.9.

Exposure context

ZoomEye reports 154 hosts matching the ApacheDS application fingerprint, while the CVE-scoped query returned no indexed assets. The fingerprint describes reachable product instances rather than confirmed vulnerable ones.

Remediation

Upgrade both affected lines, rebuild dependent applications, and verify the loaded library version. For developers, the durable fix is to bound depth, size, and per-request work at the edges where untrusted input enters.

References

• SecurityOnline advisory roundup: https://securityonline.info/apache-openoffice-vulnerability-ldap-api-traffic-server/
• NVD record for CVE-2026-103552: https://nvd.nist.gov/vuln/detail/CVE-2026-103552