Apache fixes six LDAP API flaws in one advisory batch

Apache's October 2026 advisory batch covered eight CVEs across three projects, six of them in the Directory LDAP API. CVE-2026-103552, a stack-based buffer overflow rated 7.3, is fixed in 1.2.9 alongside one other issue, while four more land in 2.1.9.

• CVE-2026-103552 is a stack overflow from deeply nested search filters, CVSS 7.3
• Four CVEs affect the 2.1.0–2.1.8 line, two affect 1.2.0–1.2.8
• No confirmed exploitation or public proof of concept
• ZoomEye found 154 hosts matching the ApacheDS fingerprint