CVE-2026-78243 Apache YuniKorn: LDAP Group provider panics on lowercase attribute name
An attacker can crash the Apache YuniKorn scheduler by triggering an out-of-bounds read in the LDAP group provider, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-78243?
CVE-2026-78243 is a low-severity denial of service vulnerability in Apache YuniKorn, published on 7 Oct 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes if a membership record does not start with "CN=".
This only affects install that have the non default LDAP group provider configured.
Users are recommended to upgrade to version 1.10.0, which fixes this issue.
Weakness: CWE-248
Which versions are affected by CVE-2026-78243?
How do I fix CVE-2026-78243?
No fix has been published for CVE-2026-78243 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-78243 being exploited?
There is no known exploitation of CVE-2026-78243 in the wild and no public exploit code.
Sources
Also known as GHSA-79rm-9vfm-ggww.