Apache Directory LDAP API flaw can consume CPU for hours
An advisory published on October 2, 2026, on the oss-sec list describes denial of service from bcrypt checks with a high cost factor in versions 2.1.0 through versions before 2.1.9.
Source: CVE-2026-103880: Apache Directory LDAP API permite negação de serviço por fator de custo excessivo do bcrypt (seclists.org). Text prepared with AI from this source.
What happened and what to do
The advisory published on October 2, 2026, on the oss-sec list rates CVE-2026-103880 as important. It describes asymmetric resource consumption in the Apache Directory LDAP API: in versions 2.1.0 through versions before 2.1.9, passwords stored with bcrypt and a high cost factor, such as 30, can keep the CPU busy for hours during credential verification, causing denial of service.
Companies using these versions can identify affected instances and configurations, upgrade to version 2.1.9 or later, and enforce limits on bcrypt cost factors. They can also monitor CPU use and authentication latency, with alerts to detect abnormal consumption before the service becomes unavailable.
How the consultancy can help
Wendelmaques can diagnose exposure in directory services and applications, define an upgrade and safe bcrypt cost limits, and implement monitoring and alerts. The scope can cover implementation and operation as agreed for the client's environment.
Next step
Send a short description of your LDAP environment to receive a scoped proposal for assessing and addressing this exposure.
Let's assess your project
I reply with scope and a proposal.