[From nobody Wed Nov 4 15:21:06 2026 Received: (at submit) by bugs.debian.org; 3 Oct 2026 21:00:24 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-107.4 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, FOURLA,FROMDEVELOPER,SPF_HELO_NONE,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 42; hammy, 150; neutral, 156; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <carnil@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:46094) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xD6qF-007uDn-2i for submit@bugs.debian.org; Sat, 03 Oct 2026 21:00:23 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Content-Transfer-Encoding:Content-Type :MIME-Version:Message-ID:Subject:To:From:Date:Reply-To:Cc:Content-ID: Content-Description:In-Reply-To:References; bh=bfBOL8fQKHmHyX+G94akgvmem7HP8Oh0R70E/qWyw74=; b=bMoWKdnwdGg8pEzciMQ0ftcy6C i5O66z8/BvuRM2QcWdHXQRq7gfwtZkVtfROiZlPBhH1gxmJNeZH7nYXlkBlXKkpXkIOPn7Jeffxio +N60TRnlmfeUGbVr2dXPr2bUNdJ+4yPrqznnqAyNMACRHG4U4Lfyh4llL/O4I/qagSMJ4LSUoc5nv YQOZptBw0DclZtg5i8dy9wMxssKcIGGvI/cuvENBlPcN2o8YDG27RLfJV0oIYP50yXpOuEPfzEzBH IyhdfDOPr3GvGuC+CulXtfqmqNLo0BaSDTWjR0HYrnI949iAdR2c+DKsmdJI0k0jdsvoBrPT7XXXW IccSRs/g==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xD6qD-001uyT-22 for submit@bugs.debian.org; Sat, 03 Oct 2026 21:00:22 +0000 Received: by eldamar.lan (Postfix, from userid 1000) id 49C6ADC0C87; Sat, 03 Oct 2026 23:00:21 +0200 (CEST) Date: Sat, 3 Oct 2026 23:00:21 +0200 From: Salvatore Bonaccorso <carnil@debian.org> To: submit@bugs.debian.org Subject: apache-directory-api: CVE-2026-102731 CVE-2026-103552 CVE-2026-103877 CVE-2026-103878 CVE-2026-103880 CVE-2026-103885 Message-ID: <asFs5RsegJTV2SsB@eldamar.lan> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit X-Debian-User: carnil Delivered-To: submit@bugs.debian.org Source: apache-directory-api Version: 2.1.2-2 X-Debbugs-CC: team@security.debian.org Severity: important Tags: security upstream Hi, The following vulnerabilities were published for apache-directory-api. CVE-2026-102731[0]: | Memory allocation with excessive size value vulnerability in Apache | Directory LDAP API. A malicious peer (or a MITM) can send a small | BER-encoded response causing a large memory allocation before any | data is received. This can lead to an OutOfMemoryError and denial of | service. The client JVM OOMs (OutOfMemoryError bypasses the | DecoderException handlers) or pins the large allocation per | connection while the attacker stalls. A handful of connections | exhausts any heap. The same bytes from an unauthenticated pre-bind | client hit any embedding server that did not set MAX_PDU_SIZE_ATTR. | This issue affects Apache Directory LDAP API: from 1.2.0 before | 1.2.9. Users are recommended to upgrade to version 1.2.9, which | fixes the issue. CVE-2026-103552[1]: | Stack Overflow vulnerability in Apache Directory LDAP API. Before | binding, a client can send a deeply nested search filter that | overflows the stack in the server's decoder. This issue affects | Apache Directory LDAP API: from 1.2.0 before 1.2.9. Users are | recommended to upgrade to version 1.2.9, which fixes the issue. CVE-2026-103877[2]: | Deserialization of Untrusted Data vulnerability in Apache Directory | LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can | answer a client's loadSchema() subschema search with a schema object | that contains a serialized Java class, allowing some potential RCE.  | This issue affects Apache Directory LDAP API: from 2.1.0 before | 2.1.9. Users are recommended to upgrade to version 2.1.9, which | fixes the issue. CVE-2026-103878[3]: | Cleartext transmission of sensitive information vulnerability in | Apache Directory LDAP API. A StartTLS extended operation started | after a Search request has been sent can lead to receive data in | plain text before the TLS Handshake has been completed. This | issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. | Users are recommended to upgrade to version 2.1.9, which fixes the | issue. CVE-2026-103880[4]: | Asymmetric Resource Consumption vulnerability in Apache Directory | LDAP API. Storing a password using the bcrypt algorithm with a | high force like 30 in a LDAP server that supports this algorithm | will cause the server CPU to  run for hours checking the | credentials. A bounded cost should be enforced to avoid a server | DOS. This issue affects Apache Directory LDAP API: from 2.1.0 | before 2.1.9. Users are recommended to upgrade to version 2.1.9, | which fixes the issue. CVE-2026-103885[5]: | Asymmetric Resource Consumption vulnerability in Apache Directory | LDAP API. A LDAP server using the LDAP API (like Apache DS) may | consume 100% of a CPU core indefinitely when processing some badly | crafted Telephone Numbers. This issue affects Apache Directory | LDAP API: from 2.1.0 before 2.1.9. Users are recommended to | upgrade to version 2.1.9, which fixes the issue. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-102731 https://www.cve.org/CVERecord?id=CVE-2026-102731 [1] https://security-tracker.debian.org/tracker/CVE-2026-103552 https://www.cve.org/CVERecord?id=CVE-2026-103552 [2] https://security-tracker.debian.org/tracker/CVE-2026-103877 https://www.cve.org/CVERecord?id=CVE-2026-103877 [3] https://security-tracker.debian.org/tracker/CVE-2026-103878 https://www.cve.org/CVERecord?id=CVE-2026-103878 [4] https://security-tracker.debian.org/tracker/CVE-2026-103880 https://www.cve.org/CVERecord?id=CVE-2026-103880 [5] https://security-tracker.debian.org/tracker/CVE-2026-103885 https://www.cve.org/CVERecord?id=CVE-2026-103885 Please adjust the affected versions in the BTS as needed. Regards, Salvatore ]