CVE-2026-78243CWE-248

CVE-2026-78243

published October 7, 2026

CVSS
2.1
EPSS
0%
Percentile
20.3
In the wild
Unconfirmed
What it is

Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes if a membership record does not start with "CN=".

This only affects install that have the non default LDAP group provider configured.

Users are recommended to upgrade to version 1.10.0, which fixes this issue.

The record
Technical detail
CVSS
2.1 · NONE
CVSS v4.0
2.1 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:N/R:A/V:D/RE:H/U:Green
EPSS
0.00288 · 20.3th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2026-10-07T14:17Z
References (2)
https://lists.apache.org/thread.html/yz51lpj6k8q2hz7x2gjdpcrk44hdn25v · [email protected]http://www.openwall.com/lists/oss-security/2026/10/07/24 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 08 OCT 03:33Z
    EPSS moved — → 0%
    epss
  • 07 OCT 09:15Z
    Apache YuniKorn: LDAP Group provider panics on lowercase attribute name
    cvelistv5