Apache fixes three resource-exhaustion flaws in LDAP API

Apache patched its Directory LDAP API: CVE-2026-103552 (stack overflow, CVSS 7.3) and CVE-2026-102731 (oversized heap allocation) are fixed in 1.2.9. Two more flaws let crafted phone numbers and high-cost bcrypt hashes pin a CPU core. No confirmed exploitation reported.

• CVE-2026-103552 is a stack overflow rated 7.3, fixed in 1.2.9
• CVE-2026-102731 causes oversized heap allocation
• Crafted phone numbers and bcrypt hashes pin a CPU core
• Affected: 2.1.0 before 2.1.9 and 1.2.0 before 1.2.9