CVE-2026-102731

UNRATEDCVSS · not yet scoredTrending — 5 sources updated this week
—
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
  • No CVSS published and no exploitation signals yet
CISA-KEV: Not listedEPSS PROB: 0.2%CVSS v2: —Exploit: None knownExposed services: Not assessed

A fix is available — apply it.

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API.

A malicious peer (or a MITM) can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service.

The client JVM OOMs (OutOfMemoryError bypasses the DecoderException handlers) or pins the large allocation per connection while the attacker stalls.

A handful of connections exhausts any heap. The same bytes from an unauthenticated pre-bind client hit any embedding server that did not set MAX_PDU_SIZE_ATTR.

This issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9.

Users are recommended to upgrade to version 1.2.9, which fixes the issue.

CVSS v3
—
EchelonGraph score
Not yet assessedNo source has published severity data for this CVE yet — no CVSS score from NVD or a CNA, no GitHub advisory, and it is not in CISA KEV. This is not a rating of zero; we cannot assess it yet.
EG Score
—
EG Risk
—
EPSS PROB
0.2%
EPSS %ILE
8th
KEV
Not listed

Published

October 2, 2026

Last Modified

October 2, 2026

References (2)

Vendor Advisories for CVE-2026-102731(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Weakness Classification(1)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

Data Freshness Timeline

(refreshed 10× in last 7d / 10× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-10-03 14:25 UTCEPSS rescore
  2. 2026-10-02 22:21 UTCGHSA enrichment
  3. 2026-10-02 22:20 UTCNVD update
  4. 2026-10-02 21:24 UTCEG score recompute
  5. 2026-10-02 21:24 UTCGHSA enrichment
  6. 2026-10-02 21:20 UTCMITRE cvelistV5
  7. 2026-10-02 14:42 UTCGHSA enrichment
  8. 2026-10-02 10:18 UTCNVD update
  9. 2026-10-02 09:31 UTCEG score recompute
  10. 2026-10-02 09:30 UTCMITRE cvelistV5first tracked

Related CVEs(same CWE)

Frequently asked(4)

What is CVE-2026-102731?
CVE-2026-102731 is a publicly disclosed vulnerability published on October 2, 2026. Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer (or a MITM) can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs…
When was CVE-2026-102731 disclosed?
CVE-2026-102731 was first published on October 2, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-102731 actively exploited?
CVE-2026-102731 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0.2% probability of exploitation in the next 30 days (8th percentile of EPSS-scored CVEs).
How do I remediate CVE-2026-102731?
A fix for CVE-2026-102731 is available — its CVE record says: "Users are recommended to upgrade to version 1.2.9, which fixes the issue." The vendor advisories EchelonGraph has for CVE-2026-102731 are linked in the Vendor Advisories panel on this page.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2026-102731

Explore →

Is Your Infrastructure Affected by CVE-2026-102731?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Book a Demo →Browse All CVEs