Read the docs
TI-2026-68954 Aliases CVE-2026-78243GHSA-79rm-9vfm-ggww

Apache YuniKorn LDAP group provider crashes on malformed group entry

Priority LOW 11CWE-248Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-248.

Summary

Apache YuniKorn from 1.8.0 before 1.10.0 crashes when configured with the non-default LDAP group resolver. An out-of-bounds read happens when a memberOf entry returned by the LDAP server does not start with CN=, which leads to an uncaught exception (CWE-248). Only installations that use the LDAP group provider are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes if a membership record does not start with "CN=". This only affects install that have the non default LDAP group provider configured.  Users are recommended to upgrade to version 1.10.0, which fixes this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00245 15th percentileScored 2026-11-07
Fix Fixed Apache YuniKorn (Apache Software Foundation): 1.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache YuniKorn1.8.0 to before 1.10.01.10.0Patch availableCNA
  • Apache YuniKorn VendorApache Affected 1.8.0 to before 1.10.0 Fixed in 1.10.0 Patch available CNA

Remediation

Upgrade Apache YuniKorn to version 1.10.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Apache YuniKorn (Apache Software Foundation) Fixed in 1.10.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache YuniKorn 1.10.0

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-68986 Admission control bypass in Apache YuniKorn via system label forgeryPriority LOW 22
    • TI-2026-68971 Apache YuniKorn admission control bypass via workload updatesPriority LOW 11
    Show all 3 records →

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-78243
  2. 2026-10-07 Alias added: GHSA-79rm-9vfm-ggww
  3. 2026-10-07 CISA SSVC decision points changed

References

Advisory 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences