The Apache Directory LDAP API contains a memory allocation vulnerability (CVE-2026-102731) where an attacker can send a crafted BER-encoded response that causes the client to allocate an excessively large amount of memory before receiving actual data. This results in an OutOfMemoryError that bypasses DecoderException handlers or pins large memory allocations per connection, allowing denial of service by exhausting heap memory with only a few connections. The vulnerability affects versions from 1.2.0 up to but not including 1.2.9. The issue can also impact embedding servers that do not set MAX_PDU_SIZE_ATTR, as unauthenticated pre-bind clients can trigger the same behavior.

Successful exploitation leads to denial of service by causing the client JVM to run out of memory or by exhausting heap memory through multiple connections. This can disrupt LDAP client operations and potentially affect embedding servers that lack proper configuration to limit PDU size.

Users should upgrade to Apache Directory LDAP API version 1.2.9 or later, which contains the fix for this vulnerability. No other mitigations are indicated. Patch status is confirmed by the vendor advisory recommending upgrade to 1.2.9.