CVE-2026-103880

{
  "etk_id": "ETK-2026-579",
  "cve_id": "CVE-2026-103880",
  "display_id": "CVE-2026-103880",
  "ghsa_id": "GHSA-q4px-5x5j-5p92",
  "euvd_id": "EUVD-2026-91359",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Resource-exhaustion flaw in Apache Directory LDAP API",
  "summary": "Apache Directory LDAP API versions 2.1.0 through 2.1.8 are affected when used by an LDAP server that supports bcrypt password verification. An attacker may cause prolonged CPU use and deny service by triggering verification of a stored bcrypt password configured with an excessively high cost factor.",
  "mitigation": "Upgrade org.apache.directory.api:api-ldap-model to version 2.1.9. Until upgraded, enforce a bounded bcrypt cost for stored passwords and limit exposure to untrusted authentication requests.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Directory LDAP API",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.1.0, < 2.1.9"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.1.9"
      ],
      "package_name": "org.apache.directory.api:api-ldap-model",
      "purl": null
    }
  ],
  "cwes": [
    405
  ],
  "cvss_score": 7.5,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": 0.0049,
  "epss_percentile": 0.4075,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.15908545,
  "t0_at": "2026-10-02T10:03:48.296000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-02T10:03:48.296000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T10:03:48.296000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103880"
    }
  }
}